Benchmark PR 3

[celmis-codereviewer]

Benchmark reproduction of ai-code-review-evaluation#3

[celmis-codereviewer]

💬 COMMENT — findings to consider

Full findings and scope are in the review summary comment on this pull request — one persistent comment, updated in place on every run.

[celmis-codereviewer]

💬 COMMENT — findings to consider

Full findings and scope are in the review summary — one persistent comment, updated in place on every run.

[celmis-codereviewer]

💬 COMMENT — findings to consider

Full findings and scope are in the review summary comment on this pull request — one persistent comment, updated in place on every run.

[celmis-codereviewer]

Why: rejectedEmails.@each on line 96 does not observe Ember array membership changes; when a rejected email is added via pushObject on line 275, emailValidation is not recomputed.

🟠 Invalid Ember dependent key for array membership observation

In Ember computed properties, @each requires a property path (e.g., @each.property). To observe array membership additions or removals when calling pushObject, rejectedEmails.[] must be used. Because rejectedEmails.@each is specified, emailValidation will fail to re-evaluate when a rejected email is pushed to rejectedEmails, preventing the validation error from displaying in the UI.

Suggested change

	}.property('accountEmail', 'rejectedEmails.@each'),
	}.property('accountEmail', 'rejectedEmails.[]'),

_{agent: defect · rule: defect.ember-dependent-key · confidence: 0.95}

[celmis-codereviewer]

Why: value can be nil when validating a record with no email on line 3; passed to email_in_restriction_setting? on line 5 or 9 and dereferenced with =~ on line 21, raising a NoMethodError exception.

🟠 NoMethodError when validating nil email value against domain settings

When validating a user record whose email is nil or absent, EmailValidator#validate_each receives value = nil. If SiteSetting.email_domains_whitelist or SiteSetting.email_domains_blacklist is set, email_in_restriction_setting? executes value =~ regexp. Since NilClass does not implement =~ in Ruby, this raises a NoMethodError: undefined method '=~' for nil:NilClass and crashes the validation pass.

Guard against nil or blank value before performing regex matching.

Suggested change

	value =~ regexp
	def email_in_restriction_setting?(setting, value)
	return false if value.blank?
	domains = setting.gsub('.', '\.')
	regexp = Regexp.new("@(#{domains})", true)
	value =~ regexp
	end

_{agent: defect · rule: defect.nil-dereference · confidence: 0.95}

[celmis-codereviewer]

Why: rejectedEmails is initialized as Em.A([]) on line 17 on the controller prototype; mutating it on line 275 shares rejected emails across all controller usages and modal re-openings.

🟡 Array initialized on Ember controller prototype shares state across usages

Defining rejectedEmails: Em.A([]) directly on the controller definition evaluates Em.A([]) once when the prototype is created. Any array mutations performed via pushObject will persist across modal re-opens and reset operations because all controller usages share the same array instance.

_{agent: defect · rule: defect.prototype-mutation · confidence: 0.90}

[celmis-codereviewer]

🤖 Code Review for PR #13

⚠ PARTIAL REVIEW — security did not run. security is a critical stage, so this review cannot be an approval. security: the model refused to review this change.

⚙ ADJUSTED — graph context partial (9 of 10 changed files): 1 of 10 changed files have no symbols in the index; 1 of them is not in that checkout at all (app/assets/javascripts/discourse/controllers/create_account_controller.js) — this PR's base is older than the indexed revision, so those files were renamed or deleted before it and no re-index can bring them back; there is nothing to fix.

💬 COMMENT — findings to consider

Findings

• 🟠 Error: 2
• 🟡 Warning: 1

Scope

• Files changed: 10
• Lines: +155 / -23

Performance

• Analysis time: 169.6s · agents: structural, cve, contract, defect · tokens: 28,960/20,019

---

_{Powered by Code Analyzer · context: tree-sitter graph + structural, cve, contract, defect}