mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-18 12:39:28 +00:00
Marius CiepluchandClaude Opus 5
c2d9c4ad01
Eight of the ten vendored access-control rows had no named handler at all, so every one of them would have scored `missing_context` forever rather than as a detector miss. After the re-harvest nine are named and the tenth states its reason. The handler-context mode now carries the class its framework registers, multi-line decorators, and commented-out guards -- `#@token_required` above a ThreatByte handler is the entire bug. Where the registration lives in another document (connexion's `operationId`, an express router), a recipe names `context = [...]`, the harvester writes that stanza per side, and the pair materializes both files at their repository-relative paths so the entry-point mapper sees the layout the project has. `harvest_recipe` fetches every blob before the first write and the driver takes `--report`, so a failed fetch leaves a reviewed excerpt exactly as it was. Two defects the re-harvest exposed: `.mjs` was not a known suffix, so the one pair vendored as an ES module had no file target at all; and `_python_route_access` matched auth words inside decorator prose, reading `@ns.doc(description='... without proper authorization checks')` as a guard. Recorded in the hygiene artifact: nine of the ten duplicate groups sit on both sides of the split, which the repository-level split cannot see. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
86 lines
2.5 KiB
JavaScript
86 lines
2.5 KiB
JavaScript
// Provenance: ZUENS2020/overleaf-with-claude exportProject (fixed).
|
|
// repo: ZUENS2020/overleaf-with-claude
|
|
// commit: 3980b9e5806defb63e45ae2696e6c1899f3a8431
|
|
// parent: 5a886aa9fb9fe4e2203f3cb1d62c91f4be0525ed
|
|
// commit_url: https://github.com/ZUENS2020/overleaf-with-claude/commit/3980b9e5806defb63e45ae2696e6c1899f3a8431
|
|
// cve:
|
|
// license: AGPL-3.0
|
|
// function: exportProject
|
|
// relpath: services/web/app/src/Features/Exports/ExportsController.mjs
|
|
// provenance: agent
|
|
// mechanism: identity_from_request_body
|
|
// upstream_start: 1
|
|
|
|
from '@overleaf/promise-utils'
|
|
import SessionManager from '../Authentication/SessionManager.mjs'
|
|
import logger from '@overleaf/logger'
|
|
import OError from '@overleaf/o-error'
|
|
import settings from '@overleaf/settings'
|
|
|
|
async function exportProject(req, res, next) {
|
|
const { project_id: projectId, brand_variation_id: brandVariationId } =
|
|
req.params
|
|
const userId = SessionManager.getLoggedInUserId(req.session)
|
|
const exportParams = {
|
|
project_id: projectId,
|
|
brand_variation_id: brandVariationId,
|
|
user_id: userId,
|
|
}
|
|
|
|
if (req.body) {
|
|
if (req.body.firstName) {
|
|
exportParams.first_name = req.body.firstName.trim()
|
|
}
|
|
if (req.body.lastName) {
|
|
exportParams.last_name = req.body.lastName.trim()
|
|
}
|
|
// additional parameters for gallery exports
|
|
if (req.body.title) {
|
|
exportParams.title = req.body.title.trim()
|
|
}
|
|
if (req.body.description) {
|
|
exportParams.description = req.body.description.trim()
|
|
}
|
|
if (req.body.author) {
|
|
exportParams.author = req.body.author.trim()
|
|
}
|
|
if (req.body.license) {
|
|
exportParams.license = req.body.license.trim()
|
|
}
|
|
if (req.body.showSource != null) {
|
|
exportParams.show_source = req.body.showSource
|
|
}
|
|
}
|
|
|
|
try {
|
|
const exportData = await ExportsHandler.exportProject(exportParams)
|
|
logger.debug(
|
|
{
|
|
userId,
|
|
projectId,
|
|
brandVariationId,
|
|
exportV1Id: exportData.v1_id,
|
|
},
|
|
'exported project'
|
|
)
|
|
return res.json({
|
|
export_v1_id: exportData.v1_id,
|
|
token: exportData.token,
|
|
message: exportData.message,
|
|
})
|
|
} catch (err) {
|
|
const info = OError.getFullInfo(err)
|
|
if (info?.forwardResponse) {
|
|
logger.debug(
|
|
{ responseError: info.forwardResponse },
|
|
'forwarding response'
|
|
)
|
|
const statusCode = info.forwardResponse.status || 500
|
|
return res.status(statusCode).json(info.forwardResponse)
|
|
}
|
|
throw err
|
|
}
|
|
}
|
|
|
|
exportProject: expressify(exportProject),
|