Conversation
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughThese changes update streaming platform integration by reformatting SSE encoding logic, extending iframe sandbox permissions for script and form execution, and refactoring event-stream parsing logic including updated field references (streaming_url), event types (PROGRESS replacing STATUS), and status-based completion branching. Changes
Sequence DiagramsequenceDiagram
participant API as Check-Platform API
participant Hook as useAnimeSearch Hook
participant UI as Platform Component
participant Browser as Browser/Iframe
API->>Hook: SSE Stream (STREAMING_URL)
Note over Hook: Check data.type === 'STREAMING_URL'<br/>Read data.streaming_url
Hook->>Hook: Set streamingUrl state
API->>Hook: SSE Stream (PROGRESS)
Note over Hook: Check data.type === 'PROGRESS'<br/>Read data.purpose
Hook->>Hook: Update statusMessage
API->>Hook: SSE Stream (COMPLETE)
alt data.status === 'failed'
Hook->>Hook: Set status='error'<br/>Set statusMessage from error<br/>Clear streamingUrl
else success
Hook->>Hook: Set status='complete'<br/>Set result from data.result<br/>Clear streamingUrl & statusMessage
end
Hook->>UI: Provide streamingUrl & status
UI->>Browser: Render iframe with<br/>sandbox="allow-same-origin<br/>allow-scripts allow-forms"
Browser->>Browser: Execute scripts & forms
Estimated Code Review Effort🎯 3 (Moderate) | ⏱️ ~22 minutes Possibly Related Issues
Poem
🚥 Pre-merge checks | ✅ 1 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (1 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
zk1tty
changed the title
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@anime-watch-hub/components/platform-card.tsx`:
- Around line 69-73: The iframe is rendering agent.streamingUrl directly and
uses a permissive sandbox ("allow-same-origin allow-scripts allow-forms");
validate and gate the URL before rendering by enforcing a strict HTTPS origin
allowlist and a safe URL format (e.g., hostname check + https scheme) where the
SSE assigns state (the useAnimeSearch hook / the code that sets
agent.streamingUrl), and remove dangerous sandbox flags (drop allow-same-origin
and allow-scripts/allow-forms unless explicitly needed); only render the
<iframe> in PlatformCard when the streamingUrl has passed the
allowlist/validation and use a minimal sandbox (no same-origin/scripts/forms) to
follow least privilege.
In `@anime-watch-hub/hooks/use-anime-search.ts`:
- Around line 60-83: The SSE parser in use-anime-search.ts is using the wrong
event shape; update the handling in the event dispatching (the code that
currently checks for data.type === 'STREAMING_URL' / 'PROGRESS' / 'COMPLETE') to
match the documented Mino schema: treat streamingUrl as a top-level field on
events (if data.streamingUrl exists, call updateAgent(platform.id, { status:
'browsing', streamingUrl: data.streamingUrl, statusMessage: 'Browsing
platform...' })), treat progress updates as type === 'STATUS' and use
data.message for statusMessage (updateAgent(platform.id, { statusMessage:
data.message })), and for COMPLETE events read data.resultJson (string) and
JSON.parse it into result before calling updateAgent(platform.id, { status:
'complete', result: parsedResult, statusMessage: undefined }); also preserve the
error branch for COMPLETE when data.status === 'failed' but read error message
from data.error?.message as before. Ensure you reference these symbols: the SSE
parsing block in use-anime-search.ts and the updateAgent(platform.id, ...)
calls.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
Run ID: a24c2676-0d6d-477b-9955-8c741a29917d
📒 Files selected for processing (3)
anime-watch-hub/app/api/check-platform/route.tsanime-watch-hub/components/platform-card.tsxanime-watch-hub/hooks/use-anime-search.ts
| src={agent.streamingUrl} | ||
| className="h-full w-full" | ||
| title={`${agent.platformName} live view`} | ||
| sandbox="allow-same-origin" | ||
| sandbox="allow-same-origin allow-scripts allow-forms" | ||
| /> |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Verify unvalidated streaming_url -> streamingUrl data flow
rg -nP --type=ts --type=tsx '\bstreaming_url\b|\bstreamingUrl\b' -C2
# Verify iframe sandbox usage and current permissions
rg -nP --type=tsx '<iframe|sandbox=' -C2Repository: tinyfish-io/tinyfish-cookbook
Length of output: 100
🏁 Script executed:
# List repository structure to understand the codebase
git ls-files | head -30Repository: tinyfish-io/tinyfish-cookbook
Length of output: 1292
🏁 Script executed:
# Search for platform-card.tsx regardless of reported type
fd "platform-card" -t fRepository: tinyfish-io/tinyfish-cookbook
Length of output: 117
🏁 Script executed:
# Also search for anime-watch-hub or similar directory patterns
fd -t d "anime" 2>/dev/null || trueRepository: tinyfish-io/tinyfish-cookbook
Length of output: 89
🏁 Script executed:
# Read the platform-card.tsx file to verify the actual code
cat -n anime-watch-hub/components/platform-card.tsxRepository: tinyfish-io/tinyfish-cookbook
Length of output: 5057
🏁 Script executed:
# Check file sizes to decide on full vs partial read
wc -l anime-watch-hub/hooks/use-anime-search.ts anime-watch-hub/lib/types.ts 2>/dev/null || trueRepository: tinyfish-io/tinyfish-cookbook
Length of output: 164
🏁 Script executed:
# Read use-anime-search.ts around lines 56-66 to verify data flow
sed -n '45,100p' anime-watch-hub/hooks/use-anime-search.tsRepository: tinyfish-io/tinyfish-cookbook
Length of output: 2016
🏁 Script executed:
# Read types.ts to check MinoAgentState definition and streamingUrl type
cat -n anime-watch-hub/lib/types.tsRepository: tinyfish-io/tinyfish-cookbook
Length of output: 1761
🏁 Script executed:
# Check the start of use-anime-search.ts to see where the SSE endpoint comes from
head -50 anime-watch-hub/hooks/use-anime-search.tsRepository: tinyfish-io/tinyfish-cookbook
Length of output: 1619
Harden iframe sandbox + validate streaming URL before render
Line 72 enables scripts and forms while line 69 renders agent.streamingUrl directly. The streamingUrl originates from external SSE payloads via /api/check-platform (anime-watch-hub/hooks/use-anime-search.ts, line 64) with no origin validation or format checking before assignment to state. This creates a high-risk trust boundary: an attacker controlling the backend or intercepting the SSE stream could inject arbitrary URLs that execute scripts inside your app frame. Gate the URL with a strict HTTPS origin allowlist and remove allow-same-origin unless absolutely required.
🔒 Suggested fix (least-privilege + allowlist)
+const TRUSTED_STREAM_ORIGINS = new Set([
+ 'https://www.crunchyroll.com',
+ 'https://www.netflix.com',
+ 'https://www.amazon.com/Prime-Video',
+ 'https://www.hulu.com',
+ 'https://www.funimation.com',
+ 'https://www.hidive.com',
+ 'https://www.disneyplus.com',
+ 'https://www.max.com',
+])
+
+function getTrustedStreamingUrl(raw?: string): string | null {
+ if (!raw) return null
+ try {
+ const u = new URL(raw)
+ if (u.protocol !== 'https:') return null
+ return TRUSTED_STREAM_ORIGINS.has(u.origin) ? u.toString() : null
+ } catch {
+ return null
+ }
+}
+
export function PlatformCard({ agent }: PlatformCardProps) {
+ const trustedStreamingUrl = getTrustedStreamingUrl(agent.streamingUrl)
...
- {agent.streamingUrl && (agent.status === 'connecting' || agent.status === 'browsing') && (
+ {trustedStreamingUrl && (agent.status === 'connecting' || agent.status === 'browsing') && (
<div className="relative aspect-video w-full overflow-hidden rounded-md border bg-muted">
<iframe
- src={agent.streamingUrl}
+ src={trustedStreamingUrl}
className="h-full w-full"
title={`${agent.platformName} live view`}
- sandbox="allow-same-origin allow-scripts allow-forms"
+ sandbox="allow-scripts allow-forms"
/>🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@anime-watch-hub/components/platform-card.tsx` around lines 69 - 73, The
iframe is rendering agent.streamingUrl directly and uses a permissive sandbox
("allow-same-origin allow-scripts allow-forms"); validate and gate the URL
before rendering by enforcing a strict HTTPS origin allowlist and a safe URL
format (e.g., hostname check + https scheme) where the SSE assigns state (the
useAnimeSearch hook / the code that sets agent.streamingUrl), and remove
dangerous sandbox flags (drop allow-same-origin and allow-scripts/allow-forms
unless explicitly needed); only render the <iframe> in PlatformCard when the
streamingUrl has passed the allowlist/validation and use a minimal sandbox (no
same-origin/scripts/forms) to follow least privilege.
| if (data.type === 'STREAMING_URL' && data.streaming_url) { | ||
| updateAgent(platform.id, { | ||
| status: 'browsing', | ||
| streamingUrl: data.streamingUrl, | ||
| streamingUrl: data.streaming_url, | ||
| statusMessage: 'Browsing platform...', | ||
| }) | ||
| } | ||
|
|
||
| if (data.type === 'STATUS' && data.message) { | ||
| updateAgent(platform.id, { statusMessage: data.message }) | ||
| if (data.type === 'PROGRESS' && data.purpose) { | ||
| updateAgent(platform.id, { statusMessage: data.purpose }) | ||
| } | ||
|
|
||
| if (data.type === 'COMPLETE') { | ||
| let result = { | ||
| available: false, | ||
| message: 'Check completed', | ||
| if (data.status === 'failed') { | ||
| updateAgent(platform.id, { | ||
| status: 'error', | ||
| statusMessage: data.error?.message ?? 'Automation failed', | ||
| streamingUrl: undefined, | ||
| }) | ||
| } else { | ||
| updateAgent(platform.id, { | ||
| status: 'complete', | ||
| result: data.result, | ||
| statusMessage: undefined, |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== Documented Mino SSE fields =="
rg -n -C2 'streamingUrl|type":"STATUS"|resultJson' anime-watch-hub/docs/mino-api-integration.md
echo
echo "== Current client parser =="
sed -n '56,85p' anime-watch-hub/hooks/use-anime-search.ts
echo
echo "== Server proxy behavior =="
sed -n '88,97p' anime-watch-hub/app/api/check-platform/route.ts
echo
echo "== Downstream UI dependence on agent.result.available =="
rg -n -C2 'result\?\.available' anime-watch-hub/components/platform-card.tsxRepository: tinyfish-io/tinyfish-cookbook
Length of output: 4228
Fix schema mismatch between Mino SSE and client parser.
The documented Mino SSE schema (lines 256–265 in anime-watch-hub/docs/mino-api-integration.md and concrete examples at lines 395–407) sends:
streamingUrlas a direct field (not undertype: 'STREAMING_URL')type: 'STATUS'withmessagefor progress updatesresultJson(stringified) inCOMPLETEevents
The hook parser (lines 60–83 in anime-watch-hub/hooks/use-anime-search.ts) currently looks for:
type: 'STREAMING_URL'withstreaming_url(field structure mismatch)type: 'PROGRESS'withpurpose(type mismatch)resultfield (schema hasresultJson)
Since /api/check-platform/route.ts proxies the upstream stream unchanged, the parser drops all streaming URL events and progress updates, and sets result: undefined on completion. This causes anime-watch-hub/components/platform-card.tsx (lines 22, 42) to render "Not Found" regardless of the actual search result.
🔧 Proposed compatibility fix
- if (data.type === 'STREAMING_URL' && data.streaming_url) {
+ const streamingUrl = data.streamingUrl ?? data.streaming_url
+ if (streamingUrl) {
updateAgent(platform.id, {
status: 'browsing',
- streamingUrl: data.streaming_url,
+ streamingUrl,
statusMessage: 'Browsing platform...',
})
}
- if (data.type === 'PROGRESS' && data.purpose) {
- updateAgent(platform.id, { statusMessage: data.purpose })
+ const progressMessage =
+ data.type === 'STATUS'
+ ? data.message
+ : data.type === 'PROGRESS'
+ ? data.purpose
+ : undefined
+ if (progressMessage) {
+ updateAgent(platform.id, { statusMessage: progressMessage })
}
if (data.type === 'COMPLETE') {
if (data.status === 'failed') {
updateAgent(platform.id, {
@@
} else {
+ const result =
+ data.result ??
+ (typeof data.resultJson === 'string'
+ ? JSON.parse(data.resultJson)
+ : data.resultJson)
+
updateAgent(platform.id, {
status: 'complete',
- result: data.result,
+ result,
statusMessage: undefined,
streamingUrl: undefined,
})
}
}🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@anime-watch-hub/hooks/use-anime-search.ts` around lines 60 - 83, The SSE
parser in use-anime-search.ts is using the wrong event shape; update the
handling in the event dispatching (the code that currently checks for data.type
=== 'STREAMING_URL' / 'PROGRESS' / 'COMPLETE') to match the documented Mino
schema: treat streamingUrl as a top-level field on events (if data.streamingUrl
exists, call updateAgent(platform.id, { status: 'browsing', streamingUrl:
data.streamingUrl, statusMessage: 'Browsing platform...' })), treat progress
updates as type === 'STATUS' and use data.message for statusMessage
(updateAgent(platform.id, { statusMessage: data.message })), and for COMPLETE
events read data.resultJson (string) and JSON.parse it into result before
calling updateAgent(platform.id, { status: 'complete', result: parsedResult,
statusMessage: undefined }); also preserve the error branch for COMPLETE when
data.status === 'failed' but read error message from data.error?.message as
before. Ensure you reference these symbols: the SSE parsing block in
use-anime-search.ts and the updateAgent(platform.id, ...) calls.
2 participants
I fixed the issues of #86
After
Summary by CodeRabbit
Release Notes
New Features
Bug Fixes