Skip to content

Conversation

@ctate
Copy link
Collaborator

@ctate ctate commented Nov 15, 2025

No description provided.

@vercel
Copy link
Contributor

vercel bot commented Nov 15, 2025

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Preview Comments Updated (UTC)
coding-agent-platform Ready Ready Preview Comment Nov 15, 2025 1:55am

Copy link
Contributor

@vercel vercel bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Additional Suggestion:

Same issue as in the chat page: parseInt without NaN validation can produce NaN if the cookie contains an invalid value.

View Details
📝 Patch Details
diff --git a/app/chat/[owner]/[repo]/page.tsx b/app/chat/[owner]/[repo]/page.tsx
index 55d71a0..7c703ed 100644
--- a/app/chat/[owner]/[repo]/page.tsx
+++ b/app/chat/[owner]/[repo]/page.tsx
@@ -21,7 +21,8 @@ export default async function ChatPage({ params }: ChatPageProps) {
 
   // Get max sandbox duration for this user (user-specific > global > env var)
   const maxSandboxDuration = await getMaxSandboxDuration(session?.user?.id)
-  const maxDuration = parseInt(cookieStore.get('max-duration')?.value || maxSandboxDuration.toString(), 10)
+  const maxDurationValue = parseInt(cookieStore.get('max-duration')?.value || maxSandboxDuration.toString(), 10)
+  const maxDuration = isNaN(maxDurationValue) ? maxSandboxDuration : maxDurationValue
 
   const stars = await getGitHubStars()
 
diff --git a/app/page.tsx b/app/page.tsx
index 137899a..ee6877c 100644
--- a/app/page.tsx
+++ b/app/page.tsx
@@ -15,7 +15,8 @@ export default async function Home() {
 
   // Get max sandbox duration for this user (user-specific > global > env var)
   const maxSandboxDuration = await getMaxSandboxDuration(session?.user?.id)
-  const maxDuration = parseInt(cookieStore.get('max-duration')?.value || maxSandboxDuration.toString(), 10)
+  const maxDurationValue = parseInt(cookieStore.get('max-duration')?.value || maxSandboxDuration.toString(), 10)
+  const maxDuration = isNaN(maxDurationValue) ? maxSandboxDuration : maxDurationValue
 
   const stars = await getGitHubStars()
 

Analysis

parseInt without NaN validation allows invalid maxDuration in cookie

What fails: parseInt() on invalid cookie values returns NaN instead of the fallback maxSandboxDuration, causing the UI Select component to render without a valid selected value and breaking the task form initialization.

How to reproduce:

  1. Navigate to the home page or chat page
  2. Manually tamper with the browser's 'max-duration' cookie and set it to a non-numeric value, e.g.: max-duration=invalid_value
  3. Reload the page
  4. The Maximum Duration select component renders without a selected value

Result: The component receives NaN for initialMaxDuration, which causes:

  • Line 685 in components/task-form.tsx: maxDuration.toString() produces "NaN"
  • The Select component can't match "NaN" against valid options like "5", "10", etc.
  • The UI displays an empty select field instead of a valid duration

Expected behavior: When a cookie contains an invalid value, the code should fall back to maxSandboxDuration (a valid number guaranteed by getMaxSandboxDuration()), ensuring maxDuration is always a valid number.

Fix: Added NaN validation after parsing:

const maxDurationValue = parseInt(cookieStore.get('max-duration')?.value || maxSandboxDuration.toString(), 10)
const maxDuration = isNaN(maxDurationValue) ? maxSandboxDuration : maxDurationValue

This matches the pattern used in lib/utils/cookies.ts getMaxDuration() function and ensures server-side consistency with client-side validation.

Affected files:

  • app/page.tsx (line 18)
  • app/chat/[owner]/[repo]/page.tsx (line 23)
Fix on Vercel


// Get max sandbox duration for this user (user-specific > global > env var)
const maxSandboxDuration = await getMaxSandboxDuration(session?.user?.id)
const maxDuration = parseInt(cookieStore.get('max-duration')?.value || maxSandboxDuration.toString(), 10)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
const maxDuration = parseInt(cookieStore.get('max-duration')?.value || maxSandboxDuration.toString(), 10)
const parsedDuration = parseInt(cookieStore.get('max-duration')?.value || '', 10)
const maxDuration = !isNaN(parsedDuration) ? parsedDuration : maxSandboxDuration

The parseInt call without NaN validation can produce NaN if the cookie contains an invalid value, which will cause UI issues in the form component where NaN.toString() won't match any valid select options.

View Details

Analysis

NaN value from unvalidated parseInt on invalid cookie breaks Select component in task form

What fails: ChatPage server component in app/chat/[owner]/[repo]/page.tsx at line 24 fails to validate the result of parseInt() when parsing the max-duration cookie. If the cookie contains any non-empty invalid string (e.g., "abc", "xyz"), parseInt returns NaN. This NaN value is then passed to ChatPageContent as initialMaxDuration and used in the task form's Select component at components/task-form.tsx line 685, where NaN.toString() produces the string "NaN" which doesn't match any valid SelectItem value, causing the form to display without a selected value.

How to reproduce:

  1. Open browser DevTools and set the cookie: max-duration=abc
  2. Navigate to the chat page (e.g., /chat/owner/repo)
  3. Open the Settings dropdown (⚙️ icon)
  4. Look at the "Maximum Duration" select field

Result: The Maximum Duration select field shows no selected value (empty placeholder instead of a valid duration like "5 minutes"). The field value is set to the invalid string "NaN" which doesn't match any option.

Expected: The Maximum Duration select should always display a valid value. According to the established pattern in lib/utils/cookies.ts lines 206-209 (getMaxDuration() function), invalid cookie values should fall back to the valid maxSandboxDuration value, ensuring the select always has a matching option.

Root cause: The code uses parseInt(cookieStore.get('max-duration')?.value || maxSandboxDuration.toString(), 10) which only applies the fallback to empty strings. Non-empty invalid strings like "abc" are parsed by parseInt, producing NaN without any validation. The fix applies the same validation pattern used throughout the codebase: parse the value with parseInt(), check isNaN(), and fall back to the default if the result is invalid.

@ctate ctate closed this Nov 15, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants