Security fixes and fix the empty value error in API Keys creation

[tomkat-cr]

[1.1.0] - 2025-09-04

Changed

• Update CHANGELOG format to be more semantic GS-222.

Fixed

• Fix the merge of "resultset" when following values has same key but empty in the "fieldValues" object (GCE_RFC Specific Functions handling, reduceAllResponses function) GS-159.
• Replace class-properties plugin with transform-class-properties to fix the "npm warn deprecated @babel/plugin-proposal-class-properties@7.18.6: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-class-properties instead." warning GS-219.
• Fix the URL parameter parsing in getUrlParams() to handle the redirect parameter with a hash (#) in the value GS-219.
• Enhance webpack configuration to conditionally log options and environment variables based on local environment detection.

Security

• Update "axios" to ^1.11.0 to fix the "form-data" CWE-343, CVE-2025-7783, CVSS 9.4 security vulnerability GS-219.
• Fix "PostCSS line return parsing error" by updating "postcss" to "^8.5.6" GS-219.
• Basic rate limiting to mitigate DoS via expensive FS operations in "server.js" GS-219.
• Enhance LoginPage redirect handling with URL sanitization GS-219.
• Add test cases for redirect functionality in LoginPage component GS-219.

[gemini-code-assist]

Summary of Changes

Hello @tomkat-cr, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request delivers a crucial set of updates focused on enhancing the application's security posture and resolving key functional issues. It includes important dependency upgrades to address known vulnerabilities, implements basic rate limiting to bolster server resilience, and refines URL handling for improved redirect safety. Additionally, it rectifies a critical bug in API key generation and improves data merging logic within the generic editor, ensuring data integrity and a more robust user experience.

Highlights

• Security Enhancements: Multiple updates to bolster the application's security, including critical dependency upgrades (axios, postcss), the implementation of basic rate limiting on the server, and enhanced URL sanitization for login page redirects to prevent open redirect vulnerabilities.
• API Key Creation Fix: Resolved an issue where API keys were generated with empty values, ensuring the access_token is correctly assigned within the resultset during the creation process.
• URL Parameter Parsing Improvement: The getUrlParams utility has been refactored to accurately parse URL parameters, specifically addressing scenarios where redirect parameters contain hash symbols, improving robustness and correctness.
• Build System & Dependency Updates: Upgraded Babel plugins to their standard-compliant versions (@babel/plugin-transform-class-properties), updated postcss and crypto-browserify, and refined webpack configuration to conditionally log options and environment variables for local development.
• Data Merging Logic Fix: Corrected an issue in the reduceAllResponses function to ensure fieldValues are merged properly, preserving array values and preventing data loss when subsequent values for the same key are empty.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request introduces several important security fixes, dependency updates, and bug fixes. The addition of URL sanitization in the login page to prevent open redirects, and the implementation of rate limiting are excellent security enhancements. The updates to dependencies like Babel, Axios, and PostCSS are also valuable for maintenance and security. The bug fixes for URL parameter parsing and data merging in reduceAllResponses improve the application's robustness. I've found one potential issue in the new data merging logic that could lead to a TypeError, and I've provided a suggestion to address it.

[gemini-code-assist]

The current logic for merging fieldValues has a potential TypeError. The check typeof mergedFieldValues[key] === 'object' evaluates to true for null values. If mergedFieldValues[key] is null, the attempt to assign a property to it inside the inner loop (e.g., mergedFieldValues[key][key2] = value2;) will throw an error. You should add a check to ensure mergedFieldValues[key] is not null before attempting to merge properties into it.

Suggested change

	if (typeof mergedFieldValues[key] === 'object' && typeof value === 'object' && value !== null) {
	for (const [key2, value2] of Object.entries(value)) {
	mergedFieldValues[key][key2] = value2;
	}
	continue;
	}
	mergedFieldValues[key] = value;
	if (typeof mergedFieldValues[key] === 'object' && mergedFieldValues[key] !== null && typeof value === 'object' && value !== null) {
	for (const [key2, value2] of Object.entries(value)) {
	mergedFieldValues[key][key2] = value2;
	}
	continue;
	}
	mergedFieldValues[key] = value;