feat: add FOSSASIA org follow (closes #42)#43
Open
serilevanjalines wants to merge 2 commits intofossasia:mainfrom
Open
feat: add FOSSASIA org follow (closes #42)#43serilevanjalines wants to merge 2 commits intofossasia:mainfrom
serilevanjalines wants to merge 2 commits intofossasia:mainfrom
Conversation
Reviewer's GuideAdds a configurable organization-follow feature that performs a DOM-based follow request for the FOSSASIA GitHub org after completing existing star/follow operations, controlled via a CONFIG.followOrganization flag. Sequence diagram for new organization follow flowsequenceDiagram
actor User
participant Script
participant GitHubOrgPage as GitHub_org_page
participant GitHubFollowEndpoint as GitHub_follow_endpoint
User->>Script: Execute_star_user_script
Script->>GitHubOrgPage: HTTP GET https://github.com/orgs/fossasia
GitHubOrgPage-->>Script: HTML_response
Script->>Script: Parse_HTML_find_form_action_follow
alt Follow_form_found
Script->>GitHubFollowEndpoint: HTTP request to form_action
GitHubFollowEndpoint-->>Script: JSON_follow_result
Script->>Script: Log_followed_org
else No_follow_form
Script->>Script: Log_already_following_org
end
Sequence diagram for updated promise chain with CONFIG.followOrganizationsequenceDiagram
participant Script
participant StarFlow as Star_repos_flow
participant FollowFlow as Follow_users_flow
participant OrgFollow as Org_follow_flow
Script->>StarFlow: Reduce_StarRepos_with_starRepo
StarFlow-->>Script: StarRepos_promise_chain
Script->>FollowFlow: Reduce_FollowUser_with_followUser
FollowFlow-->>Script: FollowUser_promise_chain
Script->>Script: Promise_all StarRepos_and_FollowUser
Script-->>Script: Then_handler
alt CONFIG_followOrganization_true
Script->>OrgFollow: followOrg fossasia
OrgFollow-->>Script: Org_follow_promise_resolved
Script->>Script: Log_Its_finally_over_wink
else CONFIG_followOrganization_false
Script->>Script: Log_Its_finally_over_wink
end
Flow diagram for CONFIG.followOrganization controlled behaviorflowchart TD
A[Script_start_after_star_and_follow_complete] --> B{CONFIG.followOrganization}
B -- true --> C[Call_followOrg_fossasia]
C --> D[Fetch_org_page_and_find_follow_form]
D --> E{Follow_form_found}
E -- yes --> F[Submit_follow_form_via_HTTP]
F --> G[Log_org_followed]
E -- no --> H[Log_already_following_org]
G --> I[Log_its_finally_over_wink]
H --> I[Log_its_finally_over_wink]
B -- false --> I[Log_its_finally_over_wink]
File-Level Changes
Possibly linked issues
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 2 security issues, and left some high level feedback:
Security issues:
- User controlled data in methods like
innerHTML,outerHTMLordocument.writeis an anti-pattern that can lead to XSS vulnerabilities (link) - User controlled data in a
div.innerHTMLis an anti-pattern that can lead to XSS vulnerabilities (link)
General comments:
- The
followOrgpromise never rejects even on HTTP/network errors or unexpected responses; consider wiring through an error callback and callingrejectso callers can handle failures explicitly. - The organization slug passed to
followOrg("fossasia") is hardcoded and separate fromStarReposandCONFIG; consider centralizing this in configuration so the org to follow is defined in one place. - Since
CONFIG.followOrganizationis introduced, you might want to structureCONFIGto be more extensible (e.g., include the org name or anorganizationsToFollowlist) to avoid scattering related constants across the file.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- The `followOrg` promise never rejects even on HTTP/network errors or unexpected responses; consider wiring through an error callback and calling `reject` so callers can handle failures explicitly.
- The organization slug passed to `followOrg` ("fossasia") is hardcoded and separate from `StarRepos` and `CONFIG`; consider centralizing this in configuration so the org to follow is defined in one place.
- Since `CONFIG.followOrganization` is introduced, you might want to structure `CONFIG` to be more extensible (e.g., include the org name or an `organizationsToFollow` list) to avoid scattering related constants across the file.
## Individual Comments
### Comment 1
<location> `star.user.js:1454` </location>
<code_context>
div.innerHTML = lol.response;
</code_context>
<issue_to_address>
**security (javascript.browser.security.insecure-document-method):** User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities
*Source: opengrep*
</issue_to_address>
### Comment 2
<location> `star.user.js:1454` </location>
<code_context>
div.innerHTML = lol.response;
</code_context>
<issue_to_address>
**security (javascript.browser.security.insecure-innerhtml):** User controlled data in a `div.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities
*Source: opengrep*
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
New Feature Added
CONFIG.followOrganization toggle that:
form[action*='/follow']selector workingTested: FOSSASIA repos - works despite CSP warnings