Skip to content

Implement SDK generator engines #14654

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 4 commits into
base: tools/pm-18793/port-credential-generator-service-to-providers
Choose a base branch
from

Conversation

adudek-bw
Copy link
Contributor

🎟️ Tracking

📔 Objective

📸 Screenshots

⏰ Reminders before review

  • Contributor guidelines followed
  • All formatters and local linters executed and passed
  • Written new unit and / or integration tests where applicable
  • Protected functional changes with optionality (feature flags)
  • Used internationalization (i18n) for all UI strings
  • CI builds passed
  • Communicated to DevOps any deployment requirements
  • Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team

🦮 Reviewer guidelines

  • 👍 (:+1:) or similar for great changes
  • 📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
  • ❓ (:question:) for questions
  • 🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
  • 🎨 (:art:) for suggestions / improvements
  • ❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
  • 🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
  • ⛏ (:pick:) for minor or nitpick changes

Copy link

codecov bot commented May 6, 2025

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 5.76%. Comparing base (382528d) to head (6a0be69).

❗ There is a different number of reports uploaded between BASE (382528d) and HEAD (6a0be69). Click for more details.

HEAD has 1 upload less than BASE
Flag BASE (382528d) HEAD (6a0be69)
2 1
Additional details and impacted files
@@                                        Coverage Diff                                         @@
##           tools/pm-18793/port-credential-generator-service-to-providers   #14654       +/-   ##
==================================================================================================
- Coverage                                                          36.34%    5.76%   -30.59%     
==================================================================================================
  Files                                                               3183       28     -3155     
  Lines                                                              92565     1736    -90829     
  Branches                                                           16676        0    -16676     
==================================================================================================
- Hits                                                               33645      100    -33545     
+ Misses                                                             56491     1636    -54855     
+ Partials                                                            2429        0     -2429     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@adudek-bw adudek-bw changed the base branch from main to tools/pm-18793/port-credential-generator-service-to-providers May 6, 2025 17:56
Copy link
Contributor

github-actions bot commented May 6, 2025

Logo
Checkmarx One – Scan Summary & Details3a94e2b2-21a9-4283-9d01-70fea741816d

New Issues (2)

Checkmarx found the following issues in this Pull Request

Severity Issue Source File / Package Checkmarx Insight
HIGH CVE-2025-4372 Npm-electron-34.0.0
detailsRecommended version: 34.5.5
Description: Use after free in WebAudio in Google Chrome prior to 136.0.7103.92 allowed a remote attacker to potentially exploit heap corruption via a crafted H...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: ImBdBE76gM96WUGRDK8OBlPU0PKy9OgOrDEDUbu1sgk%3D
Vulnerable Package
MEDIUM CVE-2025-46565 Npm-vite-5.4.6
detailsRecommended version: 5.4.19
Description: Vite is a frontend tooling framework for javascript. In vite package versions through 4.5.13, 5.0.0-beta.0 through 5.4.18, 6.0.0-alpha.0 through 6....
Attack Vector: NETWORK
Attack Complexity: LOW

ID: XNv%2BrinntZ0genA4qbaGged6qfgeio8QrvdNchdLNYg%3D
Vulnerable Package

return new GeneratedCredential(
password,
"password",
Date.now(),
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⛏️ This should use an injected date method; it shouldn't call Date.now() directly.


return new GeneratedCredential(
password,
"password",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⛏️ This should be Type.password, not a hard-coded string.


return new GeneratedCredential(
passphrase,
"password",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⛏️ This should be Type.password, not a hard-coded string.

Comment on lines +11 to +16
/** A password composed of random characters, retrieved from SDK */
sdkPassword: "sdkpassword",

/** A password composed of random words from the EFF word list, retrieved from SDK */
sdkPassphrase: "sdkpassphrase",

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⛏️ Make sure the casing is consistent between the name and value

Comment on lines +221 to +225
getGeneratorDependencies(sdk: BitwardenClient): GeneratorDependencyProvider {
const provider = this.provide.generator;
provider.sdk = sdk;
return provider;
}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ This is incorrect. this.provide.generator is a dependency that may be shared across generator instances. Assigning sdk to it makes the SDK instance visible across all providers.

🎨 It's likely that you'll need to change CredentialGeneratorProviders so that it uses a method to create a specialized GeneratorDependencyProvider with the SDK instance.

Think broadly about how that design might work. Something that produces an observable dependency you can inject on line 114 is probably best.

Copy link

sonarqubecloud bot commented May 8, 2025

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants