Epic 4 bridge - #169
Conversation
Create SafeUrlValidatorService for http/https validation. Create DomainOriginVerificationService for strict iframe networking validation.
Wire bypassSecurityTrustResourceUrl inside rendered-frame.ts through the rigorous URL validator. Swap the check in preview-bridge.ts for the strict origin verification. Fix LLM concurrency in ChatCoordinator submitPrompt. Fix Monaco model.dispose() in a2ui-composer-monaco-editor. Inject takeUntilDestroyed in api-key-selector.ts and renderer-selector.ts.
Delete debug/mock-rules/ entirely. Rip out console.error patch hacks from ChatCoordinator. Delete obsolete storage key ACTIVE_DRAFT.
…hot Capture and IDB Base
…ks into decoupled targets accurately abandoning monolithic arrays globally
…mentations and un-deferred webrtc layout code gracefully
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request refactors the chat panel and startup resolution architecture by extracting payload parsing, error formatting, system prompt generation, and environment context into dedicated services. It also introduces a shared AbstractSelector base class for settings selectors, adds safe URL validation for the renderer, and removes the MockRules component. The review feedback highlights a critical security vulnerability in the origin verification service where query-parameter origins are trusted blindly. Additionally, a regression was identified in the payload sanitization logic that fails to strip rules and mock* properties, along with suggestions to harden utility methods against nullish inputs and replace a deprecated substr() call in the Monaco editor wrapper.
| export function attemptSyntaxHealing(line: string): unknown | null { | ||
| let patched = line.trim(); |
There was a problem hiding this comment.
Following the general rules for string processing utility methods, we should harden attemptSyntaxHealing with a guard clause to safely handle nullish or undefined inputs by returning a safe default (null), preventing potential runtime crashes. Please also ensure corresponding unit tests are added to verify resilience against nullish values.
| export function attemptSyntaxHealing(line: string): unknown | null { | |
| let patched = line.trim(); | |
| export function attemptSyntaxHealing(line: string | null | undefined): unknown | null { | |
| if (!line) { | |
| return null; | |
| } | |
| let patched = line.trim(); |
References
- Harden string processing utility methods with guard clauses to safely handle nullish or undefined inputs by returning safe defaults, and ensure corresponding unit tests are added to verify resilience against nullish values.
| export function parseAndHealJsonLines(content: string): ParseResult { | ||
| let wasHealed = false; |
There was a problem hiding this comment.
Following the general rules for string processing utility methods, we should harden parseAndHealJsonLines with a guard clause to safely handle nullish or undefined inputs by returning a safe default (empty blocks), preventing potential runtime crashes. Please also ensure corresponding unit tests are added to verify resilience against nullish values.
| export function parseAndHealJsonLines(content: string): ParseResult { | |
| let wasHealed = false; | |
| export function parseAndHealJsonLines(content: string | null | undefined): ParseResult { | |
| if (!content) { | |
| return {blocks: [], wasHealed: false}; | |
| } | |
| let wasHealed = false; |
References
- Harden string processing utility methods with guard clauses to safely handle nullish or undefined inputs by returning safe defaults, and ensure corresponding unit tests are added to verify resilience against nullish values.
⚡ A2UI Composer PR PreviewYour automated preview is successfully live (commit
|
1 participant
Description
Fourth in a series of refactorings intended to clean up the A2UI Composer code.
Storage Consolidation & Host Communication Decoupling
Pre-launch Checklist
If you need help, consider asking for advice on the [discussion board].