fix: prisma.d.ts is not properly saved #1090
Conversation
WalkthroughWalkthroughThe recent updates involve two primary changes: upgrading the JetBrains IDE plugin from version "2.0.0-alpha.1" to "2.0.0-alpha.4" to enhance functionality, and modifying the file saving operations within a TypeScript project by replacing Changes
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (invoked as PR comments)
Additionally, you can add CodeRabbit Configration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Review Status
Actionable comments generated: 2
Configuration used: CodeRabbit UI
Files ignored due to path filters (14)
package.jsonis excluded by:!**/*.jsonpackages/ide/jetbrains/package.jsonis excluded by:!**/*.jsonpackages/language/package.jsonis excluded by:!**/*.jsonpackages/misc/redwood/package.jsonis excluded by:!**/*.jsonpackages/plugins/openapi/package.jsonis excluded by:!**/*.jsonpackages/plugins/swr/package.jsonis excluded by:!**/*.jsonpackages/plugins/tanstack-query/package.jsonis excluded by:!**/*.jsonpackages/plugins/trpc/package.jsonis excluded by:!**/*.jsonpackages/plugins/trpc/tests/projects/t3-trpc-v10/package.jsonis excluded by:!**/*.jsonpackages/runtime/package.jsonis excluded by:!**/*.jsonpackages/schema/package.jsonis excluded by:!**/*.jsonpackages/sdk/package.jsonis excluded by:!**/*.jsonpackages/server/package.jsonis excluded by:!**/*.jsonpackages/testtools/package.jsonis excluded by:!**/*.json
Files selected for processing (2)
- packages/ide/jetbrains/build.gradle.kts (1 hunks)
- packages/schema/src/plugins/enhancer/enhance/index.ts (1 hunks)
Additional comments: 2
packages/ide/jetbrains/build.gradle.kts (1)
- 12-12: The version update to "2.0.0-alpha.3" appears correct and is a straightforward change. Ensure compatibility with other project dependencies and configurations.
packages/schema/src/plugins/enhancer/enhance/index.ts (1)
- 52-52: The replacement of
saveSourceFilewithprismaDts.save()is aimed at enhancing file saving operations. Ensure thatprismaDts.save()is implemented securely and efficiently.Also applies to: 60-60
| `export type * from '${logicalPrismaClientDir}/index-fixed';`, | ||
| { overwrite: true } | ||
| ); | ||
| await saveSourceFile(prismaDts, options); | ||
| await prismaDts.save(); | ||
| } else { | ||
| // just reexport the prisma client | ||
| const prismaDts = project.createSourceFile( | ||
| path.join(outDir, 'prisma.d.ts'), | ||
| `export type * from '${getPrismaClientImportSpec(outDir, options)}';`, | ||
| { overwrite: true } | ||
| ); | ||
| await saveSourceFile(prismaDts, options); | ||
| await prismaDts.save(); | ||
| } | ||
|
|
||
| const enhanceTs = project.createSourceFile( |
There was a problem hiding this comment.
📝 NOTE
This review was outside the diff hunks, and no overlapping diff hunk was found. Original lines [48-48]
Potential path traversal vulnerabilities detected due to user input influencing path operations. Ensure that any user input is sanitized or validated before being used in path operations to prevent unauthorized file access.
- path.join(outDir, 'prisma.d.ts')
+ path.join(sanitizePath(outDir), 'prisma.d.ts')Note: sanitizePath is a placeholder for the actual sanitization function you implement.
Also applies to: 56-56, 64-64, 110-110, 136-136, 148-148, 163-163
📝 NOTE
This review was outside the diff hunks, and no overlapping diff hunk was found. Original lines [329-331]
Potential Regular Expression Denial-of-Service (ReDoS) vulnerabilities detected due to dynamically constructed regular expressions. Ensure that inputs to these regexes are validated or that the regex patterns are designed to be efficient and not susceptible to ReDoS.
- new RegExp(`\\${delegateModelNames.join('|')}(Unchecked)?(Create|Update).*Input`)
+ // Ensure delegateModelNames are validated or consider using a more efficient regex patternAlso applies to: 352-354
There was a problem hiding this comment.
Review Status
Actionable comments generated: 5
Configuration used: CodeRabbit UI
Files ignored due to path filters (13)
package.jsonis excluded by:!**/*.jsonpackages/ide/jetbrains/package.jsonis excluded by:!**/*.jsonpackages/language/package.jsonis excluded by:!**/*.jsonpackages/misc/redwood/package.jsonis excluded by:!**/*.jsonpackages/plugins/openapi/package.jsonis excluded by:!**/*.jsonpackages/plugins/swr/package.jsonis excluded by:!**/*.jsonpackages/plugins/tanstack-query/package.jsonis excluded by:!**/*.jsonpackages/plugins/trpc/package.jsonis excluded by:!**/*.jsonpackages/runtime/package.jsonis excluded by:!**/*.jsonpackages/schema/package.jsonis excluded by:!**/*.jsonpackages/sdk/package.jsonis excluded by:!**/*.jsonpackages/server/package.jsonis excluded by:!**/*.jsonpackages/testtools/package.jsonis excluded by:!**/*.json
Files selected for processing (3)
- packages/ide/jetbrains/build.gradle.kts (1 hunks)
- packages/plugins/trpc/tests/projects/t3-trpc-v10/.gitignore (1 hunks)
- packages/schema/src/plugins/enhancer/enhance/index.ts (3 hunks)
Files skipped from review due to trivial changes (1)
- packages/plugins/trpc/tests/projects/t3-trpc-v10/.gitignore
Files skipped from review as they are similar to previous changes (1)
- packages/ide/jetbrains/build.gradle.kts
| let logicalPrismaClientDir: string | undefined; | ||
| let dmmf: DMMF.Document | undefined; | ||
|
|
||
| if (needsLogicalClient(model)) { | ||
| const withLogicalClient = needsLogicalClient(model); | ||
|
|
||
| if (withLogicalClient) { | ||
| // schema contains delegate models, need to generate a logical prisma schema | ||
| const result = await generateLogicalPrisma(model, options, outDir); | ||
|
|
There was a problem hiding this comment.
📝 NOTE
This review was outside the diff hunks and was mapped to the diff hunk with the greatest overlap. Original lines [41-54]
The change from saveSourceFile to prismaDts.save() for saving the source file when withLogicalClient is true is a good improvement in terms of direct usage of the ts-morph library's capabilities. However, there's a potential security concern with the use of path.join without sanitizing or validating the outDir parameter, which could lead to path traversal vulnerabilities if outDir is influenced by user input.
To mitigate this, ensure that any user input influencing the outDir parameter is properly sanitized or validated before being used in path operations. Consider implementing a sanitization function or using existing libraries to help with this task.
- path.join(outDir, 'prisma.d.ts')
+ path.join(sanitizePath(outDir), 'prisma.d.ts')Note: sanitizePath is a placeholder for the actual sanitization function you implement.
📝 NOTE
This review was outside the diff hunks, and no overlapping diff hunk was found. Original lines [333-335]
The dynamic construction of a regular expression using delegateModelNames.join('|') could potentially lead to Regular Expression Denial-of-Service (ReDoS) vulnerabilities if delegateModelNames is influenced by user input or can grow unbounded.
Consider validating delegateModelNames to ensure they do not contain patterns that could lead to inefficient regex matching. Alternatively, use a more efficient regex pattern or a different approach to achieve the desired functionality without risking ReDoS.
📝 NOTE
This review was outside the diff hunks, and no overlapping diff hunk was found. Original lines [356-358]
Similar to the previous comment regarding ReDoS vulnerabilities, dynamically constructing a regular expression with delegateInfo could pose a risk if the input is not properly validated or controlled.
Ensure that inputs to these regexes are validated or consider using hardcoded regexes instead. If dynamic construction is necessary, take steps to ensure the patterns are efficient and not susceptible to ReDoS.
| path.join(outDir, 'prisma.d.ts'), | ||
| `export type * from '${getPrismaClientImportSpec(outDir, options)}';`, | ||
| { overwrite: true } | ||
| ); | ||
| await saveSourceFile(prismaDts, options); | ||
| await prismaDts.save(); |
There was a problem hiding this comment.
Similar to the previous comment, the use of path.join here also poses a potential security risk due to the possibility of path traversal vulnerabilities. It's crucial to ensure that the outDir parameter is sanitized or validated if it can be influenced by user input.
Implement a sanitization or validation step for the outDir parameter to prevent unauthorized file access.
- path.join(outDir, 'prisma.d.ts')
+ path.join(sanitizePath(outDir), 'prisma.d.ts')Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation.
| path.join(outDir, 'prisma.d.ts'), | |
| `export type * from '${getPrismaClientImportSpec(outDir, options)}';`, | |
| { overwrite: true } | |
| ); | |
| await saveSourceFile(prismaDts, options); | |
| await prismaDts.save(); | |
| path.join(sanitizePath(outDir), 'prisma.d.ts'), | |
| `export type * from '${getPrismaClientImportSpec(outDir, options)}';`, | |
| { overwrite: true } | |
| ); | |
| await prismaDts.save(); |
| import policy from './policy'; | ||
| ${options.withZodSchemas ? "import * as zodSchemas from './zod';" : 'const zodSchemas = undefined;'} | ||
| import { Prisma } from '${getPrismaClientImportSpec(outDir, options)}'; | ||
| ${logicalPrismaClientDir ? `import { type PrismaClient } from '${logicalPrismaClientDir}/index-fixed';` : ``} | ||
| ${withLogicalClient ? `import { type PrismaClient } from '${logicalPrismaClientDir}/index-fixed';` : ``} | ||
|
|
||
| export function enhance<DbClient extends object>(prisma: DbClient, context?: EnhancementContext, options?: EnhancementOptions) { | ||
| export function enhance<DbClient extends object>(prisma: DbClient, context?: EnhancementContext, options?: EnhancementOptions)${ | ||
| withLogicalClient ? ': PrismaClient' : '' | ||
| } { | ||
| return createEnhancement(prisma, { | ||
| modelMeta, | ||
| policy, | ||
| zodSchemas: zodSchemas as unknown as (ZodSchemas | undefined), | ||
| prismaModule: Prisma, | ||
| ...options | ||
| }, context)${logicalPrismaClientDir ? ' as PrismaClient' : ''}; | ||
| }, context)${withLogicalClient ? ' as PrismaClient' : ''}; | ||
| } | ||
| `, | ||
| { overwrite: true } |
There was a problem hiding this comment.
📝 NOTE
This review was outside the diff hunks and was mapped to the diff hunk with the greatest overlap. Original lines [66-83]
The creation and saving of the enhance.ts source file are correctly implemented. However, the use of path.join without sanitizing or validating the outDir parameter could lead to path traversal vulnerabilities, similar to the previous instances.
Ensure the outDir parameter is sanitized or validated to prevent potential security risks.
- path.join(outDir, 'enhance.ts')
+ path.join(sanitizePath(outDir), 'enhance.ts')
Summary by CodeRabbit
.gitignorefile to ignorepackage.jsonand ensure proper newline at the end.