✨ feat: enter room #219
Merged
✨ feat: enter room #219
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
JohnsonMao
force-pushed
the
feature/enter-room
branch
from
3f14a03 to
19dc6a6
Compare
JohnsonMao
requested review from
HongLinLiao,
ttpss930141011,
Parkerhiphop,
bxbdev and
Yuwen-ctw
Yuwen-ctw
approved these changes
Jun 29, 2023
ttpss930141011
approved these changes
Jun 30, 2023
JohnsonMao
force-pushed
the
feature/enter-room
branch
from
19dc6a6 to
c2c268b
Compare
|
@Parkerhiphop @ttpss930141011 @Yuwen-ctw 我有個小問題想請教一下 // 某個文件定義
export const roomEntryError: Record<RoomEntryError["message"], string> = {
"room is full": "房間人數已滿!",
"wrong password": "房間密碼錯誤!",
"you can only join 1 room": "一人只能進入一間房!",
};
// 在需要 handle error 並轉成中文的 component 使用
.catch((err: AxiosError<RoomEntryError>) => {
const roomEnterErrorKey = err.response?.data.message;
const errorMessage = roomEnterErrorKey
? roomEntryError[roomEnterErrorKey]
: "error!";
firePopup({ title: errorMessage });
})目前運行是可以呈現中文字，但在弱點掃描時 .catch((err: AxiosError<RoomEntryError>) => {
const errorMessage = err.response?.data.message || "error!";
firePopup({ title: errorMessage });
}) |
|
Hello @JohnsonMao ， 若上述假設為真，那疑問是，任何程式碼中以任何形式出現 'password' 都是不被允許的嗎？不管是包含 password 的字串、或名為 password 的變數與檔案名稱都不行？ 但立即想到一個例外，就是
以上是我可能會嘗試的方向，供參考，謝謝。 |
|
Hi @Yuwen-ctw & @JohnsonMao , 看起來它是判斷 value 耶
|
|
Hello @ttpss930141011 |
JohnsonMao
force-pushed
the
feature/enter-room
branch
from
c2c268b to
e997d05
Compare
|
恩，我後來看了一下，應該是弱點掃描誤以為那個是敏感資料的設定檔 const roomEntryErrors = [
{ errMsg: 'room is full', errMsgCn: '房間人數已滿!' },
{ errMsg: 'wrong password', errMsgCn: '房間密碼錯誤!' },
{ errMsg: 'you can only join 1 room', errMsgCn: '一人只能進入一間房!' }
]但我更偏好用 |
|
@JohnsonMao @Yuwen-ctw @ttpss930141011 感謝討論！ 我也是最近才開始摸 SonarCloud 和理解他的一些原則 "Hardcoded Credential" 是指直接把敏感資料直接寫在程式碼中的軟體實踐，像是 user IDs and passwords，也因此 Yuwen 在 SonarCloud 上才會查到說我們應該要把這些資料存在資料庫裡，像是存一個 User Table 那樣 在更改錯誤訊息格式後，也確實如同 Yuwen 所指出，應該是把 password 寫成 key-value pair 時被判斷成我們實作了 Hardcoded Credential，而單純把 password 當成 value 或一個 string 在寫的話應該就會沒問題。 回到這個 issue 的話，這就是一個假陽性 (False Positive) 的判斷，官方有建議這種情形可以標注一下他是假陽性就好 單純就這個判斷的處理方式，我認為改個 key name （像是 不過在往上思考的話，這也要看後端是如何回傳錯誤訊息的，晚上我們來跟後端討論一下回傳的錯誤訊息，避免我們這邊做了很多結果都沒跟後端對上，因為也有團隊選擇是在後端做 i18n，讓前端的 Error handle 都只要單純 return error msg |
|
Kudos, SonarCloud Quality Gate passed!
|
|
✅ Knip Scan Result for 0e25930 Unused files (8)
Unused dependencies (3)
Unused devDependencies (5)
Unused exports (3)
Unused exports in namespaces (7)
Unused exported types (22)
Unused exported types in namespaces (33)
Duplicate exports (10)
Configuration issues (1)
|
|
🤖 Lighthouse Scan Result for 0e25930 /rooms
/rooms/abc
/login
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Why need this change? / Root cause:
Changes made:
EnterPrivateRoomModalcomponent by extracting the logic for entering a room to theRoomListViewcontainerTest Scope / Change impact:
Issue