Skip to content
This repository was archived by the owner on Jul 3, 2026. It is now read-only.

bug: fixing infinate loading bug by adding proper exception handling #644

Closed
yashchaud wants to merge 1 commit into from
Closed

bug: fixing infinate loading bug by adding proper exception handling #644

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 13 additions & 8 deletions frontend/src/pages/Setup.vue
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,10 @@
</p>
</div>

<div class="flex flex-col py-5 gap-3">
<div v-if="createTeam.error" class="flex flex-col py-5 gap-3">
<p class="text-sm text-center text-ink-red-3" v-html="createTeam.error.messages?.[0]"></p>

@greptile-apps greptile-apps Bot Jun 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 security XSS risk via v-html — createTeam.error.messages?.[0] is a server-returned string that may embed user-supplied values (e.g. usernames, email addresses). Rendering it with v-html bypasses Vue's auto-escaping. If any user-controlled input ever surfaces in the error message, a crafted payload would execute in the victim's browser. Use text interpolation or v-text instead.

Suggested change
<p class="text-sm text-center text-ink-red-3" v-html="createTeam.error.messages?.[0]"></p>
<p class="text-sm text-center text-ink-red-3">{{ createTeam.error.messages?.[0] }}</p>
Prompt To Fix With AI 
This is a comment left during a code review.
Path: frontend/src/pages/Setup.vue
Line: 20

Comment:
XSS risk via `v-html` — `createTeam.error.messages?.[0]` is a server-returned string that may embed user-supplied values (e.g. usernames, email addresses). Rendering it with `v-html` bypasses Vue's auto-escaping. If any user-controlled input ever surfaces in the error message, a crafted payload would execute in the victim's browser. Use text interpolation or `v-text` instead.

```suggestion
              <p class="text-sm text-center text-ink-red-3">{{ createTeam.error.messages?.[0] }}</p>
```

How can I resolve this? If you propose a fix, please make it concise.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

</div>
<div v-else class="flex flex-col py-5 gap-3">
<LoadingIndicator class="size-5 self-center" />
<div class="text-sm text-center">Just a minute...</div>
</div>
Expand All @@ -37,12 +40,14 @@ import { createTeam } from '@/resources/permissions'

const route = useRoute()

createTeam.submit(
{ personal: 1 },
{
onSuccess: (data) => {
if (data) window.location.replace(route.query['redirect-to'] || '/drive')
onMounted(() => {
createTeam.submit(
{ personal: 1 },
{
onSuccess: (data) => {
if (data) window.location.replace(route.query['redirect-to'] || '/drive')
},
},
}
)
)
})
</script>
Loading