Develop -> Master (31 Oct)#2576
Merged
Merged
Conversation
…d` utility - Replaced inline browser download logic with the reusable `triggerBrowserDownload` utility. - Simplified `handleDownload` function for improved readability and maintainability. - Added JSDoc for enhanced code documentation.
# Conflicts: # Clients/src/presentation/components/Modals/Basic/index.tsx
- Added `triggerBrowserDownload` and `extractFilenameFromHeaders` utilities for cleaner and reusable browser download logic. - Updated `handleDownload` and `handleAutoDownload` to leverage shared download functionality. - Enhanced maintainability by reducing duplicate code and following DRY principles.
- Added `handleFileManagerDownload` and `handleFileDelete` functions for downloading and deleting files from the file manager. - Updated `handleDownload` and `handleAutoDownload` with consistent formatting and error handling. - Improved compatibility with `feature/file-manager-tables`.
- Replaced inline filename extraction logic with the shared `extractFilenameFromHeaders` utility to ensure consistency and maintain DRY principles. - Updated `IconButton` dropdown actions to include "remove" for "evidence" type.
…nd type safety - Added `Promise<number>` type to ensure return type clarity. - Enhanced filename extraction with defensive logic to handle missing or malformed `Content-Disposition` headers. - Added null check for `Content-Type` header to improve robustness.
…eanup - Replaced `path.resolve` with `fs.realpathSync` for symlink-aware validation. - Added error handling for path resolution failures. - Strengthened containment checks to prevent directory traversal using symlinks. - Improved logging for unresolved paths during cleanup.
- Moved error handling for path resolution failures below containment checks. - Enhanced logging with formatted messages for unresolved paths and violations. - Ensured cleanup process proceeds gracefully despite resolution errors.
- Simplified rate limiting middleware by relying on the default `keyGenerator` for IP handling. - Updated comments to reflect support for IPv6 and Express trust proxy behavior.
- Enhanced error handling for file deletion to detect partial failures and raise appropriate exceptions. - Modularized temp file cleanup and authentication validation into reusable utilities. - Improved logging for cleanup errors and unauthorized actions. - Strengthened type checks and ensured consistent behavior across file operations.
…obust IP handling - Added centralized `baseRateLimitConfig` for shared settings across limiters. - Introduced a robust `getClientIp` utility for reliable IP extraction with multiple fallbacks. - Modularized rate limit handlers using `createRateLimitHandler` for standardized responses. - Improved logging and error handling for rate limit violations. - Updated all limiters (file operations, general API, auth) to use new utilities.
… cleanup - Implemented `fs.realpathSync` to ensure symlink-aware validation during file deletion. - Added containment checks to prevent directory traversal attacks and log violations. - Enhanced cleanup logic to ignore already-deleted files while maintaining robust error handling.
…h validation - Added filename sanitization to allow only safe characters (alphanumeric, underscore, hyphen, dot). - Reconstructed file paths using trusted inputs to prevent directory traversal. - Improved symlink-aware validation and ensured files are strictly contained within the temp directory. - Enhanced error handling, logging violations, and handling edge cases like missing or non-existent files. - Maintained asynchronous behavior for non-blocking cleanup.
…g parameters - Updated response format using `STATUS_CODE[200]` utility for consistency. - Replaced explicit `userId` type conversion with cleaner usage. - Improved code readability and standardized response structure.
…ngthen rate limiting - Moved tenant format validation to `authenticateUpload` for centralized validation logic. - Improved rate limiting by rejecting requests without identifiable IPs, ensuring stricter security.
…ions - Introduced centralized `RATE_LIMIT_CONFIGS` for predefined settings. - Replaced custom IP extraction with express-rate-limit's built-in IPv6-safe handling. - Streamlined rate limiters (file operations, general API, auth) with `createRateLimiter` utility. - Improved logging for rate limit violations with normalized IP handling.
…ility - Updated all `console.error` and `console.warn` calls to use `logger.error` and `logger.warn` respectively. - Integrated `fileLogger` utility into `fileManager`, `middleware`, and `routes` to ensure standardized logging.
- Exported `FileMetadata` and `FileManagerResponse` for shared usage across modules. - Introduced `FileUploadResponse` interface for structured upload response typing. - Updated API methods (`getFileById`, `getUserFilesMetaData`, `uploadFileToManager`, `downloadFileFromManager`) to utilize typed responses. - Refined return types for better clarity and type alignment across file operations.
- Extended `FileMetadata` to include `uploadedBy`, enhancing information stored for each file.
…gement - Introduced `FileManagerUploadModal` to handle file uploads with drag-and-drop and browse options. - Includes file validation, upload progress tracking, error handling, and success states. - Integrated Material-UI components and lucide-react icons for UI consistency.
…gement - Introduced `FileManagerUploadModal` to handle file uploads with drag-and-drop and browse options. - Includes file validation, upload progress tracking, error handling, and success states. - Integrated Material-UI components and lucide-react icons for UI consistency.
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Potential fix for code scanning alert no. 10: Missing rate limiting
…om user-controlled sources Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Potential fix for code scanning alert no. 12: Database query built from user-controlled sources
MuhammadKhalilzadeh
approved these changes
Nov 3, 2025
…r-Table Ks 038 oct 31 file manager table
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Potential fix for code scanning alert no. 10: Missing rate limiting
When the sidebar is collapsed, the Management dropdown menu items were being cut off. This fixes the issue by: - Adjusting anchor positioning to show the menu to the right when collapsed - Adding minimum width to ensure proper display of all menu items
…verflow Fix Management dropdown overflow in collapsed sidebar
Fix: Multi-Report Data Type
- Create reusable tabUtils utility for tab labels with count badges - Add counts to Vendors and Risks tabs in Vendors page - Add counts to Models, Model risks, and MLFlow data tabs in Model Inventory - Add counts to Resources and Subprocessors tabs in AI Trust Center - Badge design: green circular style with adaptive width for 1-2 digits
Add count badges to tab labels
…into hp-nov-3-link-models-with-projects-and-frameworks
…-projects-and-frameworks Link models with projects and frameworks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
9 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Describe your changes
Write your issue number after "Fixes "
Enter the corresponding issue number after "Fixes #"
Please ensure all items are checked off before requesting a review: