chore(lint): toggle import/no-named-as-default to error level + fix all violations#42214
chore(lint): toggle import/no-named-as-default to error level + fix all violations#42214hainenber wants to merge 2 commits into
import/no-named-as-default to error level + fix all violations#42214Conversation
… all violations Signed-off-by: hainenber <dotronghai96@gmail.com>
|
AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR). |
![codeant-ai-for-open-source[bot]](https://avatars.githubusercontent.com/u/151810221?s=60&v=4){kind=small}
| export const DesignSystem = () => ( | ||
| <> | ||
| <Markdown> | ||
| <MarkdownToJsx> |
There was a problem hiding this comment.
Suggestion: Wrapping this markdown block in MarkdownToJsx now renders the embedded raw HTML anchor, which includes target="_blank" without rel="noopener noreferrer". That introduces a reverse-tabnabbing risk in rendered docs/stories; update the rendered link markup (or markdown renderer overrides) so external blank-target links always include a safe rel value. [security]
Severity Level: Major ⚠️
- ❌ Storybook design docs expose reverse-tabnabbing external link.
- ⚠️ Potential account hijack via malicious external site.Steps of Reproduction ✅
1. Start the Storybook dev server that loads stories from
`superset-frontend/packages/superset-ui-core/src/components` (Storybook discovers
`*.stories.tsx` files; this file defines a `default` export at lines 22-24 naming the
story "Design System/Introduction").
2. In the Storybook UI, navigate to the "Design System/Introduction" story defined by
`export default { title: 'Design System/Introduction' };` at
`superset-frontend/packages/superset-ui-core/src/components/DesignSystem.stories.tsx:22-24`.
3. Observe that the `DesignSystem` story component at lines 26-42 wraps a markdown string
in `<MarkdownToJsx>` (line 28) which includes raw HTML for an external link at lines
36-38: `<a href="https://bradfrost.com/blog/post/atomic-web-design/" target="_blank">Intro
to Atomic Design</a>`.
4. Using browser devtools on the rendered story, inspect the "Intro to Atomic Design" link
and confirm the anchor is rendered with `target="_blank"` and no `rel` attribute; clicking
it opens a new tab while preserving `window.opener`, enabling reverse-tabnabbing if the
external site is compromised.
(Use Cmd/Ctrl + Click for best experience)
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** superset-frontend/packages/superset-ui-core/src/components/DesignSystem.stories.tsx
**Line:** 28:28
**Comment:**
*Security: Wrapping this markdown block in `MarkdownToJsx` now renders the embedded raw HTML anchor, which includes `target="_blank"` without `rel="noopener noreferrer"`. That introduces a reverse-tabnabbing risk in rendered docs/stories; update the rendered link markup (or markdown renderer overrides) so external blank-target links always include a safe `rel` value.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix
|
The security concern regarding reverse-tabnabbing is valid. When using Since <MarkdownToJsx
options={{
overrides: {
a: {
props: {
target: '_blank',
rel: 'noopener noreferrer',
},
},
},
}}
>
{markdownContent}
</MarkdownToJsx>Alternatively, if you prefer to update the markdown content directly, you can manually add the Regarding other comments on this PR, the provided comment file is empty, so there are no additional suggestions to address. superset-frontend/packages/superset-ui-core/src/components/DesignSystem.stories.tsx |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #42214 +/- ##
==========================================
- Coverage 65.19% 65.18% -0.01%
==========================================
Files 2768 2768
Lines 156081 156081
Branches 35719 35719
==========================================
- Hits 101754 101748 -6
- Misses 52365 52371 +6
Partials 1962 1962
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Signed-off-by: hainenber <dotronghai96@gmail.com>
Code Review Agent Run #44457dActionable Suggestions - 0Additional Suggestions - 4
Review Details
Bito Usage GuideCommands Type the following command in the pull request comment and save the comment.
Refer to the documentation for additional commands. Configuration This repository uses Documentation & Help AI Code Review powered by |
1 participant
chore(lint): toggle
import/no-named-as-defaultto error level + fix all violationsSUMMARY
Continuation of usual house cleaning ops.
BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
N/A
TESTING INSTRUCTIONS
Green CI as acceptance threshold
ADDITIONAL INFORMATION