fix(security): remediate 44 SonarQube vulnerabilities#25
Open
devin-ai-integration[bot] wants to merge 1 commit into
Open
fix(security): remediate 44 SonarQube vulnerabilities#25devin-ai-integration[bot] wants to merge 1 commit into
devin-ai-integration[bot] wants to merge 1 commit into
Conversation
BLOCKER fixes: - S2699: Add assertions to 9 test cases missing them (spec files) - S7651: Rename 'toggle' Output to 'favoriteToggle'/'followToggle' to avoid collision with standard DOM event (favorite-button, follow-button) MAJOR fixes: - S2933: Add 'readonly' modifier to 8 class members never reassigned - S5914: Replace trivially-true 'expect(true).toBe(true)' with meaningful assertions - S5254: Add lang='en' attribute to <html> element - S6850: Add screen-reader accessible content to heading element MINOR fixes: - S7764: Replace 'window' with 'globalThis' in jwt.service.ts and app.config.ts - S7765: Use .includes() instead of .indexOf() in editor.component.ts - S7773: Use Number.parseInt instead of parseInt in home.component.ts - S1874: Replace deprecated BrowserDynamicTestingModule with BrowserTestingModule - S7735: Refactor negated conditions in favorite-button and follow-button - S5725: Add crossorigin attribute and https scheme to CDN links - ImgWithoutAltCheck: Add alt attributes to 3 images - MouseEventWithoutKeyboardEquivalentCheck: Add keyboard event to tag remove icon Co-Authored-By: sachet.agarwal <sachet.agarwal@windsurf.com>
Author
🤖 Devin AI EngineerI'll be helping with this pull request! Here's what you should know: ✅ I will automatically:
Note: I can only respond to comments from users who have write access to this repository. ⚙️ Control Options:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Remediates all 44 open SonarQube issues identified in the pre-scan across 23 files. Fixes span all severity levels (11 BLOCKER, 15 MAJOR, 18 MINOR) covering code quality, accessibility, security, and test correctness.
Fix Breakdown by Severity
Key Changes
expect(true).toBe(true)with actual result checks@Output() toggletofavoriteToggle/followToggleto avoid collision with standard DOMtoggleevent; updated all template bindingsreadonlyto 8 class members that are never reassignedwindow.localStoragewithglobalThis.localStoragein jwt.service.ts; replacedwindow.__conduit_debug__withglobalThis.__conduit_debug__in app.config.ts (updated type declaration accordingly)BrowserDynamicTestingModule/platformBrowserDynamicTestingwithBrowserTestingModule/platformBrowserTestingin test-setup and all spec fileslang="en"to<html>elementcrossorigin="anonymous"and converted protocol-relative URLs to HTTPS for CDN links.indexOf() < 0with!.includes(); replacedparseIntwithNumber.parseInt(keyup.enter)keyboard handler,tabindex, androle="button"to tag remove iconBuild Verification
bun run buildpasses cleanlybun run format— no formatting issuesbun run test) fail on main with pre-existingzone.jsresolution error (not a dependency in package.json) — not caused by this PRReview & Testing Checklist for Human
@Output()rename fromtoggletofavoriteToggle/followToggledoesn't break any custom event bindings outside the changed templatesglobalThisusage works in all target browsers (should be fine for modern Angular apps)BrowserTestingModulemigration — ensure test infrastructure is compatible with Angular 21Notes
crossorigin="anonymous"and converting to HTTPS. Full SRI hashes are impractical for Google Fonts (content varies by user-agent) and Ionicons (hash not published). These are security hotspot reviews rather than definitive vulnerabilities.mainbranch: all 6 spec files fail withzone.jsimport resolution error. This is an environment/dependency issue unrelated to this PR.Link to Devin session: https://app.devin.ai/sessions/782940b10b794b14967f0559947272e8
Requested by: @SachetCognition
Devin Review