Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[PM-11588] Bugfix - parse user input value for combined expiry date when creating/adding a card cipher #11103

Merged
merged 10 commits into from
Sep 24, 2024

Conversation

jprusik
Copy link
Contributor

@jprusik jprusik commented Sep 17, 2024

🎟️ Tracking

PM-11588

📔 Objective

When a combined expiration value is captured from a payment form to be added to/create a new cipher, the date value is not parsed to the separate expMonth and expYear properties.

🦮 Reviewer guidelines

  • 👍 (:+1:) or similar for great changes
  • 📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
  • ❓ (:question:) for questions
  • 🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
  • 🎨 (:art:) for suggestions / improvements
  • ❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
  • 🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
  • ⛏ (:pick:) for minor or nitpick changes

@jprusik jprusik requested review from a team as code owners September 17, 2024 15:07
@jprusik jprusik self-assigned this Sep 17, 2024
@jprusik jprusik marked this pull request as draft September 17, 2024 15:08
Copy link
Contributor

github-actions bot commented Sep 17, 2024

Logo
Checkmarx One – Scan Summary & Details8ff62910-1083-439b-bb40-a96eac650d6a

New Issues

Severity Issue Source File / Package Checkmarx Insight
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 484 Attack Vector

Copy link

codecov bot commented Sep 17, 2024

Codecov Report

Attention: Patch coverage is 96.00000% with 5 lines in your changes missing coverage. Please review.

Project coverage is 35.15%. Comparing base (992964f) to head (5870a1f).
Report is 33 commits behind head on main.

✅ All tests successful. No failed tests found.

Files with missing lines Patch % Lines
...wser/src/autofill/background/overlay.background.ts 57.14% 3 Missing ⚠️
...vault/popup/components/vault/add-edit.component.ts 0.00% 1 Missing ⚠️
...angular/src/vault/components/add-edit.component.ts 0.00% 1 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main   #11103      +/-   ##
==========================================
+ Coverage   35.05%   35.15%   +0.10%     
==========================================
  Files        2711     2712       +1     
  Lines       84576    84661      +85     
  Branches    16069    16093      +24     
==========================================
+ Hits        29649    29766     +117     
+ Misses      53956    53924      -32     
  Partials      971      971              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@jprusik jprusik marked this pull request as ready for review September 17, 2024 19:19
Copy link
Contributor

@cagonzalezcs cagonzalezcs left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I really like the extensive test suite you implemented for the utils methods, nice work on this.

My biggest suggestion would be to consider breaking down the parseYearMothExpiry method into several targeted functions. Reading through the nested if/else structure can be tricky..

I don't have any major blockers at the moment, just suggestions. Let me know when you want a re-review of this.

apps/browser/src/autofill/background/overlay.background.ts Outdated Show resolved Hide resolved
libs/common/src/vault/utils.ts Outdated Show resolved Hide resolved
* @param {string} combinedExpiryValue
* @return {*} {([string | null, string | null])}
*/
export function parseYearMonthExpiry(combinedExpiryValue: string): [Year | null, string | null] {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎨 - This method is crazy busy... might be a good idea to break this down into separate methods that handle scoped logical concerns... even if those methods aren't exported, it'd help with maintaining the business logic later on.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, totally. I made a few attempts to consolidate cases for conciseness, but the resulting logic ended up doing unnecessary evaluations (less-likely cases). That's not to say we can't break things up internally, but I need to think about how to make that understandable, a bit more.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

addressed in 0722aff

Comment on lines 109 to 110
// If the parsed delimiter is a whitespace character, assign 's' (character class) instead
const delimiterPattern = /\s/.test(parsedDelimiter) ? "\\s" : "\\" + parsedDelimiter;
Copy link
Contributor Author

@jprusik jprusik Sep 18, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A caveat here; this does have the downside of treating all whitespace characters stored in CardExpiryDateDelimiters as equivalent to each other during this string splitting/normalization. This is fine for now, but if we ever need to explicitly distinguish different whitespace characters from each other (though I don't think that need will be likely) we'll need to rethink some of this.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've been putting these utility functions in vault as that seemed the most appropriate functional domain (rather than team ownership), but I'm open to other thoughts on location

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So no need to change this really if you don't want... but I feel like if we're writing the validation code here, then it makes sense to incorporate this as part of Autofill team's scope, even if it applies to other external elements.

I'm in favor of pulling the work to our scope.

cagonzalezcs
cagonzalezcs previously approved these changes Sep 18, 2024
cagonzalezcs
cagonzalezcs previously approved these changes Sep 19, 2024
shane-melton
shane-melton previously approved these changes Sep 19, 2024
Copy link
Member

@shane-melton shane-melton left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Vault changes look good!

djsmith85
djsmith85 previously approved these changes Sep 19, 2024
Copy link
Contributor

@djsmith85 djsmith85 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approving for tools.

Just another conflict that needs to be resolved before this can be merged

@jprusik
Copy link
Contributor Author

jprusik commented Sep 19, 2024

@jprusik jprusik merged commit e88e231 into main Sep 24, 2024
72 checks passed
@jprusik jprusik deleted the pm-11588 branch September 24, 2024 14:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants