Skip to content

Conversation

RomneyDa
Copy link
Collaborator

@RomneyDa RomneyDa commented Sep 22, 2025

Description

#7908
Reopening this with requested changes:

  • remove extraneous build script changes

@RomneyDa RomneyDa requested a review from a team as a code owner September 22, 2025 23:46
@RomneyDa RomneyDa requested review from tingwai and removed request for a team September 22, 2025 23:46
@dosubot dosubot bot added the size:L This PR changes 100-499 lines, ignoring generated files. label Sep 22, 2025
@RomneyDa RomneyDa requested a review from sestinj September 22, 2025 23:47
Copy link
Contributor

@cubic-dev-ai cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

10 issues found across 9 files

Prompt for AI agents (all 10 issues)

Understand the root cause of the following 10 issues and fix them.


<file name="extensions/vscode/src/extension/VsCodeMessenger.ts">

<violation number="1" location="extensions/vscode/src/extension/VsCodeMessenger.ts:295">
Non-PNG images are all forced to image/jpeg; gif/webp/svg (and others) will be mislabeled, causing incorrect data URLs.</violation>

<violation number="2" location="extensions/vscode/src/extension/VsCodeMessenger.ts:295">
Extension comparison is case-sensitive; uppercase extensions (e.g., .PNG) are misclassified, producing the wrong MIME type.</violation>
</file>

<file name="gui/src/components/mainInput/TipTapEditor/TipTapEditor.tsx">

<violation number="1" location="gui/src/components/mainInput/TipTapEditor/TipTapEditor.tsx:226">
Unconditional hide overrides delayed/conditional logic in onDragLeave, making the delay and Shift-key behavior ineffective.</violation>

<violation number="2" location="gui/src/components/mainInput/TipTapEditor/TipTapEditor.tsx:241">
onDrop does not prevent default, which can cause the browser to navigate/open the dropped file when dropping outside the editor area. Add event.preventDefault() to avoid data loss risk.</violation>
</file>

<file name="gui/src/components/mainInput/TipTapEditor/utils/editorConfig.ts">

<violation number="1" location="gui/src/components/mainInput/TipTapEditor/utils/editorConfig.ts:151">
Drop handler prevents default and returns true even when nothing is handled, likely blocking normal text/URL drops. Consider only preventing default/returning true when an image is actually processed, otherwise fall through.</violation>

<violation number="2" location="gui/src/components/mainInput/TipTapEditor/utils/editorConfig.ts:189">
Image from HTML drop is inserted at position 0 instead of the intended drop/caret position.</violation>
</file>

<file name="gui/src/components/mainInput/TipTapEditor/utils/imageUtils.ts">

<violation number="1" location="gui/src/components/mainInput/TipTapEditor/utils/imageUtils.ts:44">
Avoid logging absolute local file paths to prevent leaking sensitive user information.</violation>

<violation number="2" location="gui/src/components/mainInput/TipTapEditor/utils/imageUtils.ts:66">
Avoid logging the full response object; it may contain large base64 data and sensitive content. Log only metadata (e.g., type or status) instead.</violation>

<violation number="3" location="gui/src/components/mainInput/TipTapEditor/utils/imageUtils.ts:146">
Logging the entire HTML content can expose sensitive data and add overhead. Prefer logging a short, non-sensitive summary.</violation>

<violation number="4" location="gui/src/components/mainInput/TipTapEditor/utils/imageUtils.ts:154">
Do not log full resource URLs that may include local file paths; log a generic message instead.</violation>
</file>

React with 👍 or 👎 to teach cubic. Mention @cubic-dev-ai to give feedback, ask questions, or re-run the review.

const fileUri = vscode.Uri.file(filepath);
const fileContents = await vscode.workspace.fs.readFile(fileUri);
const fileType =
filepath.split(".").pop() === "png" ? "image/png" : "image/jpeg";
Copy link
Contributor

@cubic-dev-ai cubic-dev-ai bot Sep 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Non-PNG images are all forced to image/jpeg; gif/webp/svg (and others) will be mislabeled, causing incorrect data URLs.

Prompt for AI agents
Address the following comment on extensions/vscode/src/extension/VsCodeMessenger.ts at line 295:

<comment>Non-PNG images are all forced to image/jpeg; gif/webp/svg (and others) will be mislabeled, causing incorrect data URLs.</comment>

<file context>
@@ -287,6 +287,18 @@ export class VsCodeMessenger {
+      const fileUri = vscode.Uri.file(filepath);
+      const fileContents = await vscode.workspace.fs.readFile(fileUri);
+      const fileType =
+        filepath.split(&quot;.&quot;).pop() === &quot;png&quot; ? &quot;image/png&quot; : &quot;image/jpeg&quot;;
+      const dataUrl = `data:${fileType};base64,${Buffer.from(
+        fileContents,
</file context>
Fix with Cubic

const fileUri = vscode.Uri.file(filepath);
const fileContents = await vscode.workspace.fs.readFile(fileUri);
const fileType =
filepath.split(".").pop() === "png" ? "image/png" : "image/jpeg";
Copy link
Contributor

@cubic-dev-ai cubic-dev-ai bot Sep 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Extension comparison is case-sensitive; uppercase extensions (e.g., .PNG) are misclassified, producing the wrong MIME type.

Prompt for AI agents
Address the following comment on extensions/vscode/src/extension/VsCodeMessenger.ts at line 295:

<comment>Extension comparison is case-sensitive; uppercase extensions (e.g., .PNG) are misclassified, producing the wrong MIME type.</comment>

<file context>
@@ -287,6 +287,18 @@ export class VsCodeMessenger {
+      const fileUri = vscode.Uri.file(filepath);
+      const fileContents = await vscode.workspace.fs.readFile(fileUri);
+      const fileType =
+        filepath.split(&quot;.&quot;).pop() === &quot;png&quot; ? &quot;image/png&quot; : &quot;image/jpeg&quot;;
+      const dataUrl = `data:${fileType};base64,${Buffer.from(
+        fileContents,
</file context>
Suggested change
filepath.split(".").pop() === "png" ? "image/png" : "image/jpeg";
(filepath.split(".").pop() || "").toLowerCase() === "png" ? "image/png" : "image/jpeg";
Fix with Cubic

}
});
event.preventDefault();
// Let the event bubble to ProseMirror by not preventing default
Copy link
Contributor

@cubic-dev-ai cubic-dev-ai bot Sep 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

onDrop does not prevent default, which can cause the browser to navigate/open the dropped file when dropping outside the editor area. Add event.preventDefault() to avoid data loss risk.

Prompt for AI agents
Address the following comment on gui/src/components/mainInput/TipTapEditor/TipTapEditor.tsx at line 241:

<comment>onDrop does not prevent default, which can cause the browser to navigate/open the dropped file when dropping outside the editor area. Add event.preventDefault() to avoid data loss risk.</comment>

<file context>
@@ -221,40 +222,23 @@ function TipTapEditorInner(props: TipTapEditorProps) {
-          }
-        });
-        event.preventDefault();
+        // Let the event bubble to ProseMirror by not preventing default
       }}
     &gt;
</file context>
Suggested change
// Let the event bubble to ProseMirror by not preventing default
event.preventDefault();
Fix with Cubic

} else {
setTimeout(() => setShowDragOverMsg(false), 2000);
setTimeout(() => {
setShowDragOverMsg(false);
Copy link
Contributor

@cubic-dev-ai cubic-dev-ai bot Sep 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unconditional hide overrides delayed/conditional logic in onDragLeave, making the delay and Shift-key behavior ineffective.

Prompt for AI agents
Address the following comment on gui/src/components/mainInput/TipTapEditor/TipTapEditor.tsx at line 226:

<comment>Unconditional hide overrides delayed/conditional logic in onDragLeave, making the delay and Shift-key behavior ineffective.</comment>

<file context>
@@ -221,40 +222,23 @@ function TipTapEditorInner(props: TipTapEditorProps) {
           } else {
-            setTimeout(() =&gt; setShowDragOverMsg(false), 2000);
+            setTimeout(() =&gt; {
+              setShowDragOverMsg(false);
+            }, 2000);
           }
</file context>
Fix with Cubic

const plugin = new Plugin({
props: {
handleDOMEvents: {
drop(view, event) {
Copy link
Contributor

@cubic-dev-ai cubic-dev-ai bot Sep 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Drop handler prevents default and returns true even when nothing is handled, likely blocking normal text/URL drops. Consider only preventing default/returning true when an image is actually processed, otherwise fall through.

Prompt for AI agents
Address the following comment on gui/src/components/mainInput/TipTapEditor/utils/editorConfig.ts at line 151:

<comment>Drop handler prevents default and returns true even when nothing is handled, likely blocking normal text/URL drops. Consider only preventing default/returning true when an image is actually processed, otherwise fall through.</comment>

<file context>
@@ -147,6 +148,80 @@ export function createEditorConfig(options: {
           const plugin = new Plugin({
             props: {
               handleDOMEvents: {
+                drop(view, event) {
+                  // Hide drag overlay immediately when drop is handled
+                  setShowDragOverMsg(false);
</file context>
Fix with Cubic

const node = schema.nodes.image.create({
src: dataUrl,
});
const tr = view.state.tr.insert(0, node);
Copy link
Contributor

@cubic-dev-ai cubic-dev-ai bot Sep 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Image from HTML drop is inserted at position 0 instead of the intended drop/caret position.

Prompt for AI agents
Address the following comment on gui/src/components/mainInput/TipTapEditor/utils/editorConfig.ts at line 189:

<comment>Image from HTML drop is inserted at position 0 instead of the intended drop/caret position.</comment>

<file context>
@@ -147,6 +148,80 @@ export function createEditorConfig(options: {
+                        const node = schema.nodes.image.create({
+                          src: dataUrl,
+                        });
+                        const tr = view.state.tr.insert(0, node);
+                        view.dispatch(tr);
+                      }
</file context>
Fix with Cubic

return undefined;
}

console.log("Extracted filepath:", filepath);
Copy link
Contributor

@cubic-dev-ai cubic-dev-ai bot Sep 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Avoid logging absolute local file paths to prevent leaking sensitive user information.

Prompt for AI agents
Address the following comment on gui/src/components/mainInput/TipTapEditor/utils/imageUtils.ts at line 44:

<comment>Avoid logging absolute local file paths to prevent leaking sensitive user information.</comment>

<file context>
@@ -2,6 +2,159 @@ import { IIdeMessenger } from &quot;../../../../context/IdeMessenger&quot;;
+    return undefined;
+  }
+
+  console.log(&quot;Extracted filepath:&quot;, filepath);
+
+  try {
</file context>
Suggested change
console.log("Extracted filepath:", filepath);
console.log("Extracted filepath");
Fix with Cubic

return undefined;
}

console.log("Found VS Code resource URL:", vscodeResourceUrl);
Copy link
Contributor

@cubic-dev-ai cubic-dev-ai bot Sep 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do not log full resource URLs that may include local file paths; log a generic message instead.

Prompt for AI agents
Address the following comment on gui/src/components/mainInput/TipTapEditor/utils/imageUtils.ts at line 154:

<comment>Do not log full resource URLs that may include local file paths; log a generic message instead.</comment>

<file context>
@@ -2,6 +2,159 @@ import { IIdeMessenger } from &quot;../../../../context/IdeMessenger&quot;;
+    return undefined;
+  }
+
+  console.log(&quot;Found VS Code resource URL:&quot;, vscodeResourceUrl);
+  return await handleVSCodeResourceUrl(ideMessenger, vscodeResourceUrl);
+}
</file context>
Suggested change
console.log("Found VS Code resource URL:", vscodeResourceUrl);
console.log("Found VS Code resource URL");
Fix with Cubic

ideMessenger: IIdeMessenger,
html: string,
): Promise<string | undefined> {
console.log("Processing HTML for VS Code resource URL:", html);
Copy link
Contributor

@cubic-dev-ai cubic-dev-ai bot Sep 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Logging the entire HTML content can expose sensitive data and add overhead. Prefer logging a short, non-sensitive summary.

Prompt for AI agents
Address the following comment on gui/src/components/mainInput/TipTapEditor/utils/imageUtils.ts at line 146:

<comment>Logging the entire HTML content can expose sensitive data and add overhead. Prefer logging a short, non-sensitive summary.</comment>

<file context>
@@ -2,6 +2,159 @@ import { IIdeMessenger } from &quot;../../../../context/IdeMessenger&quot;;
+  ideMessenger: IIdeMessenger,
+  html: string,
+): Promise&lt;string | undefined&gt; {
+  console.log(&quot;Processing HTML for VS Code resource URL:&quot;, html);
+
+  const vscodeResourceUrl = extractVSCodeResourceUrlFromHtml(html);
</file context>
Suggested change
console.log("Processing HTML for VS Code resource URL:", html);
console.log("Processing HTML for VS Code resource URL");
Fix with Cubic


const response = await Promise.race([requestPromise, timeoutPromise]);

console.log("Got response from ideMessenger.request:", response);
Copy link
Contributor

@cubic-dev-ai cubic-dev-ai bot Sep 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Avoid logging the full response object; it may contain large base64 data and sensitive content. Log only metadata (e.g., type or status) instead.

Prompt for AI agents
Address the following comment on gui/src/components/mainInput/TipTapEditor/utils/imageUtils.ts at line 66:

<comment>Avoid logging the full response object; it may contain large base64 data and sensitive content. Log only metadata (e.g., type or status) instead.</comment>

<file context>
@@ -2,6 +2,159 @@ import { IIdeMessenger } from &quot;../../../../context/IdeMessenger&quot;;
+
+    const response = await Promise.race([requestPromise, timeoutPromise]);
+
+    console.log(&quot;Got response from ideMessenger.request:&quot;, response);
+    console.log(&quot;Response type:&quot;, typeof response);
+
</file context>
Suggested change
console.log("Got response from ideMessenger.request:", response);
console.log("Got response from ideMessenger.request");
Fix with Cubic

@sestinj
Copy link
Contributor

sestinj commented Sep 23, 2025

@aadarshkt it doesn't appear that I have access to push to this PR, could you either change this or run the following and add a commit?

git checkout main -- .vscode/launch.json
git checkout main -- .vscode/tasks.json

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
size:L This PR changes 100-499 lines, ignoring generated files.
Projects
Status: Todo
Development

Successfully merging this pull request may close these issues.

3 participants