Fix repo URL generation to handle GitLab, Bitbucket, SSH, and local repos in the UI by davidkopp · Pull Request #1783 · green-coding-solutions/green-metrics-tool

davidkopp · 2026-07-19T20:50:26Z

Previously, commit and tree URLs were hardcoded to GitHub's /commit/ and /tree/ path format. This broke links for:

GitLab repos (which use /-/commit/ and /-/tree/)
Bitbucket repos (use /commits/ and /src/)
SSH-style URIs (e.g., git@github.com:org/repo) — not converted to HTTPS
Local paths — produced broken file:///commit/... links

Changes:

Added getRepoRefUrl(uri, type) in frontend/js/helpers/main.js that normalizes URIs to HTTPS and selects the correct path convention per platform (GitHub /commit/, GitLab /-/commit/, Bitbucket /commits/)
Replaced inline toHttpsUri(...)/commit/... constructions in charts.js, stats.js, and timeline.js with the new helper
Removed the now-unnecessary buildCommitLink() function from stats.js
Non-HTTP URIs (local paths) now show commit info as plain text instead of a broken link
href attribute-breakout fixes — added escapeString() for user-controlled URL values interpolated into double-quoted href attributes (stats.js for uri/relations.url/commit_link + commit_hash and main.js:createExternalIconLink).
Updated test_xss_protection_of_run_data to prefix the payload with ">, so it actually breaks out of double-quoted attribute values (closing both the attribute and the surrounding start tag), exercising the href-escaping fixes that the previous plain payload silently skipped.

Disclaimer: I used DeepSeek V4 Flash and GLM 5.2 for this PR.

Summary

Added centralized repository URL generation for GitHub, GitLab, Bitbucket, SSH, and local repositories.
Updated charts, stats, and timeline commit links to use the new helper.
Displayed local repository commits as plain text.
Escaped generated href attributes to prevent XSS vulnerabilities.
Added coverage for repository URL formats, local paths, and malicious attribute values.
Removed the obsolete buildCommitLink() helper.

davidkopp · 2026-07-22T19:26:06Z

Example that shows that the url of commit hashes is wrong if a SSH git repo is used:

ArneTR · 2026-07-23T11:53:19Z

@coderabbitai review

coderabbitai · 2026-07-23T11:53:34Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

coderabbitai · 2026-07-23T11:56:15Z

📝 Walkthrough

Walkthrough

Frontend repository links now use a shared helper that normalizes URIs and generates host-specific commit or tree paths. Chart, timeline, and stats rendering conditionally displays links for supported repositories and escapes generated href attributes. Stats relation URLs also fall back to plain text when they are not absolute HTTP(S) URLs. Frontend tests cover multiple repository URI formats and expanded XSS payloads in run data.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main UI repo URL generation fix and mentions the key supported repository types.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 3

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b8dc35cc-cf9a-43c5-ab7b-b19ab114cc42

📥 Commits

Reviewing files that changed from the base of the PR and between a5cc16d and e3d1226.

📒 Files selected for processing (5)

frontend/js/helpers/charts.js
frontend/js/helpers/main.js
frontend/js/stats.js
frontend/js/timeline.js
tests/frontend/test_frontend.py

ArneTR · 2026-07-23T12:14:27Z

@davidkopp dont be startled by the AI reviews. Not everything is relevant. I just triggered it to have more data for a comprehensive manual review tomorrow.

First though: thanks for the PR! ❤️

ArneTR

The code is very clean and nicely readable.

The refactor is definitely an improvement also. Thanks for that.

I made a remark on some error handling that I found to be a bit harsh. See inline.

Other than that: Please have a look at the CodeRabbit remarks. They look very reasonable.

Would love to bring the PR then in after!

ArneTR · 2026-07-27T09:30:25Z

+    const cleanUri = toHttpsUri(uri);
+    if (!cleanUri.startsWith('http')) return null;
+    if (type !== 'commit' && type !== 'tree') {
+        throw new Error(`getRepoRefUrl: unknown type '${type}', expected 'commit' or 'tree'`);


this feels a bit harsh, as it will block the whole frontend from rendering for code that comes after. Maybe just return a "broken URL" string or something and log error to console.err?

davidkopp · 2026-07-28T04:45:17Z

I implemented all the comments except the one regarding commit_hash escaping. This one seems to be unnecessary to me, as the commit_hash can not include malicious code. Or do you prefer more defensively code?

ArneTR · 2026-07-28T07:50:07Z

Looks good. Running tests and then bringing in :)

ArneTR · 2026-07-29T10:29:23Z

Sorry, the tests do not run. GitHub is so slow the last days that the connection to apt package repositories and then after test runs take up to 24 hours to run ...

I will try updating the branch to make sure this is not some stale test or caching issue and see again :/

davidkopp added 5 commits July 19, 2026 20:56

Fix commit hash urls for SSH and local repos

19319bc

Fix display of GitLab commit urls

0e5debb

Refactorings

f4619d0

Add test

20d6786

Fix URL-related XSS vulnerabilities

e3d1226

coderabbitai Bot reviewed Jul 23, 2026

View reviewed changes

Comment thread frontend/js/helpers/main.js

Comment thread frontend/js/stats.js

Comment thread frontend/js/timeline.js Outdated

ArneTR reviewed Jul 27, 2026

View reviewed changes

Implement review comments

b687ddc

Merge branch 'main' into fix-urls-in-ui

1a3ac4b

Uh oh!

Conversation

davidkopp commented Jul 19, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

davidkopp commented Jul 22, 2026

Uh oh!

ArneTR commented Jul 23, 2026

Uh oh!

coderabbitai Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Jul 23, 2026

Walkthrough

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ArneTR commented Jul 23, 2026

Uh oh!

ArneTR left a comment

Choose a reason for hiding this comment

Uh oh!

ArneTR Jul 27, 2026

Choose a reason for hiding this comment

Uh oh!

davidkopp Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

davidkopp commented Jul 28, 2026

Uh oh!

ArneTR commented Jul 28, 2026

Uh oh!

ArneTR commented Jul 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

davidkopp commented Jul 19, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 23, 2026 •

edited

Loading