[NAE-1944] Server-side JavaScript Code Injection (SSJI) #240

Kovy95 · 2024-02-01T07:39:14Z

Description

change Map<String, Object> to POJO object
write test

Fixes NAE-1944

Dependencies

none

Third party dependencies

No new dependencies were introduced

Blocking Pull requests

There are no dependencies on other PR

How Has Been This Tested?

1 test in PetriNetServiceTest

Test Configuration

Name	Tested on
OS	Linux Mint 20
Runtime
Dependency Manager
Framework version
Run parameters
Other configuration

Checklist:

- change Map<String, Object> to POJO object - write test

pull-request-quantifier-deprecated · 2024-02-01T07:39:19Z

This PR has 188 quantified lines of changes. In general, a change size of upto 200 lines is ideal for the best PR experience!

Quantification details

Label      : Medium
Size       : +157 -31
Percentile : 57.6%

Total files changed: 12

Change summary by file extension:
.java : +77 -30
.groovy : +41 -1
.xml : +39 -0

Change counts above are quantified counts, based on the PullRequestQuantifier customizations.

Why proper sizing of changes matters

Optimal pull request sizes drive a better predictable PR flow as they strike a
balance between between PR complexity and PR review overhead. PRs within the
optimal size (typical small, or medium sized PRs) mean:

Fast and predictable releases to production:
- Optimal size changes are more likely to be reviewed faster with fewer
  iterations.
- Similarity in low PR complexity drives similar review times.
Review quality is likely higher as complexity is lower:
- Bugs are more likely to be detected.
- Code inconsistencies are more likely to be detected.
Knowledge sharing is improved within the participants:
- Small portions can be assimilated better.
Better engineering practices are exercised:
- Solving big problems by dividing them in well contained, smaller problems.
- Exercising separation of concerns within the code changes.

What can I do to optimize my changes

Use the PullRequestQuantifier to quantify your PR accurately
- Create a context profile for your repo using the context generator
- Exclude files that are not necessary to be reviewed or do not increase the review complexity. Example: Autogenerated code, docs, project IDE setting files, binaries, etc. Check out the Excluded section from your prquantifier.yaml context profile.
- Understand your typical change complexity, drive towards the desired complexity by adjusting the label mapping in your prquantifier.yaml context profile.
- Only use the labels that matter to you, see context specification to customize your prquantifier.yaml context profile.
Change your engineering behaviors
- For PRs that fall outside of the desired spectrum, review the details and check if:
  - Your PR could be split in smaller, self-contained PRs instead
  - Your PR only solves one particular issue. (For example, don't refactor and code new features in the same PR).

How to interpret the change counts in git diff output

One line was added: +1 -0
One line was deleted: +0 -1
One line was modified: +1 -1 (git diff doesn't know about modified, it will
interpret that line like one addition plus one deletion)
Change percentiles: Change characteristics (addition, deletion, modification)
of this PR in relation to all other PRs within the repository.

Was this comment helpful? 👍 :ok_hand: :thumbsdown: (Email)
Customize PullRequestQuantifier for this repository.

mazarijuraj · 2024-02-07T09:58:55Z

src/main/java/com/netgrif/application/engine/workflow/service/ConfigurableMenuService.java

-        Map<String, Object> requestQuery = new HashMap<>();
-        requestQuery.put("author.email", author.getEmail());
+        PetriNetSearch requestQuery = new PetriNetSearch();
+        Author authorQuery = new Author();


authorQuery is not used, should it be set to requestQuery?

mazarijuraj · 2024-02-07T10:00:50Z

src/test/groovy/com/netgrif/application/engine/petrinet/service/PetriNetServiceTest.groovy

+        long processCount = petriNetRepository.count()
+
+        petriNetService.importPetriNet(stream(NET_SEARCH_FILE), VersionType.MAJOR, superCreator.getLoggedSuper())
+        petriNetService.importPetriNet(stream(NET_FILE), VersionType.MAJOR, superCreator.getLoggedSuper())


Would be better to use different author for one net to see if search by author works properly

mazarijuraj · 2024-02-07T10:02:22Z

src/test/groovy/com/netgrif/application/engine/petrinet/service/PetriNetServiceTest.groovy

@@ -160,4 +168,51 @@ class PetriNetServiceTest {
        List<PetriNet> petriNets = petriNetService.findAllByUriNodeId(myNode.id)
        assert petriNets.size() == 2
    }
+
+    @Test
+    void processSearch() {


All searches use only one query param at a time, it would be better to also test request with multiple params (eg. author + version + identifier)

pull-request-quantifier-deprecated · 2024-02-09T09:49:39Z

This PR has 188 quantified lines of changes. In general, a change size of upto 200 lines is ideal for the best PR experience!

Quantification details

Label      : Medium
Size       : +157 -31
Percentile : 57.6%

Total files changed: 12

Change summary by file extension:
.java : +77 -30
.groovy : +41 -1
.xml : +39 -0

Change counts above are quantified counts, based on the PullRequestQuantifier customizations.

Why proper sizing of changes matters

Optimal pull request sizes drive a better predictable PR flow as they strike a
balance between between PR complexity and PR review overhead. PRs within the
optimal size (typical small, or medium sized PRs) mean:

Fast and predictable releases to production:
- Optimal size changes are more likely to be reviewed faster with fewer
  iterations.
- Similarity in low PR complexity drives similar review times.
Review quality is likely higher as complexity is lower:
- Bugs are more likely to be detected.
- Code inconsistencies are more likely to be detected.
Knowledge sharing is improved within the participants:
- Small portions can be assimilated better.
Better engineering practices are exercised:
- Solving big problems by dividing them in well contained, smaller problems.
- Exercising separation of concerns within the code changes.

What can I do to optimize my changes

Use the PullRequestQuantifier to quantify your PR accurately
- Create a context profile for your repo using the context generator
- Exclude files that are not necessary to be reviewed or do not increase the review complexity. Example: Autogenerated code, docs, project IDE setting files, binaries, etc. Check out the Excluded section from your prquantifier.yaml context profile.
- Understand your typical change complexity, drive towards the desired complexity by adjusting the label mapping in your prquantifier.yaml context profile.
- Only use the labels that matter to you, see context specification to customize your prquantifier.yaml context profile.
Change your engineering behaviors
- For PRs that fall outside of the desired spectrum, review the details and check if:
  - Your PR could be split in smaller, self-contained PRs instead
  - Your PR only solves one particular issue. (For example, don't refactor and code new features in the same PR).

How to interpret the change counts in git diff output

One line was added: +1 -0
One line was deleted: +0 -1
One line was modified: +1 -1 (git diff doesn't know about modified, it will
interpret that line like one addition plus one deletion)
Change percentiles: Change characteristics (addition, deletion, modification)
of this PR in relation to all other PRs within the repository.

Was this comment helpful? 👍 :ok_hand: :thumbsdown: (Email)
Customize PullRequestQuantifier for this repository.

- fix according to PR

pull-request-quantifier-deprecated · 2024-02-09T14:11:34Z

This PR has 201 quantified lines of changes. In general, a change size of upto 200 lines is ideal for the best PR experience!

Quantification details

Label      : Large
Size       : +170 -31
Percentile : 60.1%

Total files changed: 12

Change summary by file extension:
.java : +78 -30
.groovy : +53 -1
.xml : +39 -0

Change counts above are quantified counts, based on the PullRequestQuantifier customizations.

Why proper sizing of changes matters

Optimal pull request sizes drive a better predictable PR flow as they strike a
balance between between PR complexity and PR review overhead. PRs within the
optimal size (typical small, or medium sized PRs) mean:

Fast and predictable releases to production:
- Optimal size changes are more likely to be reviewed faster with fewer
  iterations.
- Similarity in low PR complexity drives similar review times.
Review quality is likely higher as complexity is lower:
- Bugs are more likely to be detected.
- Code inconsistencies are more likely to be detected.
Knowledge sharing is improved within the participants:
- Small portions can be assimilated better.
Better engineering practices are exercised:
- Solving big problems by dividing them in well contained, smaller problems.
- Exercising separation of concerns within the code changes.

What can I do to optimize my changes

Use the PullRequestQuantifier to quantify your PR accurately
- Create a context profile for your repo using the context generator
- Exclude files that are not necessary to be reviewed or do not increase the review complexity. Example: Autogenerated code, docs, project IDE setting files, binaries, etc. Check out the Excluded section from your prquantifier.yaml context profile.
- Understand your typical change complexity, drive towards the desired complexity by adjusting the label mapping in your prquantifier.yaml context profile.
- Only use the labels that matter to you, see context specification to customize your prquantifier.yaml context profile.
Change your engineering behaviors
- For PRs that fall outside of the desired spectrum, review the details and check if:
  - Your PR could be split in smaller, self-contained PRs instead
  - Your PR only solves one particular issue. (For example, don't refactor and code new features in the same PR).

How to interpret the change counts in git diff output

One line was added: +1 -0
One line was deleted: +0 -1
One line was modified: +1 -1 (git diff doesn't know about modified, it will
interpret that line like one addition plus one deletion)
Change percentiles: Change characteristics (addition, deletion, modification)
of this PR in relation to all other PRs within the repository.

Was this comment helpful? 👍 :ok_hand: :thumbsdown: (Email)
Customize PullRequestQuantifier for this repository.

[NAE-1944] Server-side JavaScript Code Injection (SSJI)

87fcd93

- change Map<String, Object> to POJO object - write test

Kovy95 added critical A change that is critical to a release and must not be omitted Medium labels Feb 1, 2024

Kovy95 requested review from Retoocs, tuplle, renczesstefan, machacjozef and mazarijuraj February 1, 2024 07:39

Kovy95 self-assigned this Feb 1, 2024

mazarijuraj requested changes Feb 7, 2024

View reviewed changes

machacjozef changed the base branch from NAE-1906 to release/6.4.0 February 8, 2024 10:05

Merge branch 'release/6.4.0' into NAE-1944

2633e14

Kovy95 added 2 commits February 9, 2024 14:37

[NAE-1944] Server-side JavaScript Code Injection (SSJI)

8d1b210

- fix according to PR

Merge remote-tracking branch 'origin/NAE-1944' into NAE-1944

b1802f5

Kovy95 requested a review from mazarijuraj February 9, 2024 13:38

pull-request-quantifier-deprecated bot added Large and removed Medium labels Feb 9, 2024

renczesstefan approved these changes Feb 12, 2024

View reviewed changes

machacjozef merged commit dceaa01 into release/6.4.0 Feb 13, 2024
5 of 6 checks passed

machacjozef deleted the NAE-1944 branch February 13, 2024 08:37

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[NAE-1944] Server-side JavaScript Code Injection (SSJI) #240

[NAE-1944] Server-side JavaScript Code Injection (SSJI) #240

Kovy95 commented Feb 1, 2024 •

edited by jira bot

Loading

pull-request-quantifier-deprecated bot commented Feb 1, 2024

What can I do to optimize my changes

How to interpret the change counts in git diff output

mazarijuraj Feb 7, 2024

Kovy95 Feb 9, 2024

mazarijuraj Feb 7, 2024

Kovy95 Feb 9, 2024

mazarijuraj Feb 7, 2024

Kovy95 Feb 9, 2024

pull-request-quantifier-deprecated bot commented Feb 9, 2024

What can I do to optimize my changes

How to interpret the change counts in git diff output

pull-request-quantifier-deprecated bot commented Feb 9, 2024

What can I do to optimize my changes

How to interpret the change counts in git diff output

[NAE-1944] Server-side JavaScript Code Injection (SSJI) #240

[NAE-1944] Server-side JavaScript Code Injection (SSJI) #240

Conversation

Kovy95 commented Feb 1, 2024 • edited by jira bot Loading

Description

Dependencies

Third party dependencies

Blocking Pull requests

How Has Been This Tested?

Test Configuration

Checklist:

pull-request-quantifier-deprecated bot commented Feb 1, 2024

What can I do to optimize my changes

How to interpret the change counts in git diff output

mazarijuraj Feb 7, 2024

Choose a reason for hiding this comment

Kovy95 Feb 9, 2024

Choose a reason for hiding this comment

mazarijuraj Feb 7, 2024

Choose a reason for hiding this comment

Kovy95 Feb 9, 2024

Choose a reason for hiding this comment

mazarijuraj Feb 7, 2024

Choose a reason for hiding this comment

Kovy95 Feb 9, 2024

Choose a reason for hiding this comment

pull-request-quantifier-deprecated bot commented Feb 9, 2024

What can I do to optimize my changes

How to interpret the change counts in git diff output

pull-request-quantifier-deprecated bot commented Feb 9, 2024

What can I do to optimize my changes

How to interpret the change counts in git diff output

Kovy95 commented Feb 1, 2024 •

edited by jira bot

Loading