scriptoriumadmin/GitNexus
1
0
Fork 0
mirror of https://github.com/abhigyanpatwari/GitNexus.git synced 2026-09-24 00:51:53 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 7
490 commits 122 branches 977 tags 208 MiB
Commit graph

8 commits

Author SHA1 Message Date
jreakin
2bd04fe2c4 test: add positive/negative tests for O(1) lookup optimizations 
8 tests verifying the data structures underlying performance changes:

nodeById Map (O(1) lookup):
  + Map.get returns correct node by ID
  + duplicate IDs: last wins
  - non-existent ID returns undefined
  - empty Map returns undefined

Set.has (O(1) highlight matching):
  + present IDs return true
  - absent IDs return false
  + handles IDs with colons, dots, slashes
  - case-sensitive matching

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-23 10:16:33 -05:00
jreakin
f4bb78c03a test: add negative tests for CSV generation 
- empty graph produces header-only CSVs (no data rows)
- empty graph relCSV has only header
- double quotes in node names are RFC 4180 escaped
- file node without fileContents gets empty content (no crash)
- community with empty keywords array produces valid CSV
- unknown node labels are silently skipped

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-23 08:21:31 -05:00
jreakin
47f9b6c48d fix: add multi-language NodeLabel types, close old db/conn, CSV tests 
- Add 15 multi-language labels to NodeLabel union (Struct, Trait, Impl,
  TypeAlias, Const, Static, Namespace, Union, Typedef, Macro, Property,
  Record, Delegate, Annotation, Constructor, Template) — eliminates
  unsafe casts in csv-generator
- Close previous conn/db before recreating in loadGraphToLbug to prevent
  WASM resource leaks across repo switches
- Add 7 CSV generation tests: multi-language tables, column count,
  keyword comma escaping, file content, relation CSV, all NODE_TABLES

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-23 08:21:31 -05:00
jreakin
57e087de49 fix(web): strip quoted strings before readOnly keyword check 
The readOnly guard was matching keywords inside string literals,
blocking legitimate queries like WHERE n.name CONTAINS "delete".
Now strips single/double-quoted strings before checking, so only
actual Cypher write keywords outside strings are blocked.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-23 05:09:44 -05:00
jreakin
fc6c114570 fix(web): MermaidDiagram XSS, isSafeId allows @, rawMermaid typed 
- Add DOMPurify.sanitize() to MermaidDiagram.tsx dangerouslySetInnerHTML
  (was rendering AI-generated SVG unsanitized — the highest-risk surface)
- Add @ to isSafeId regex for scoped npm packages (@angular/core, etc.)
- Add rawMermaid to ProcessData interface, remove (process as any) casts
- Update security tests: @scope/pkg now accepted, @angular/core added

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-23 05:01:57 -05:00
jreakin
208ade9b11 fix: add / back to isSafeId — node IDs contain file paths 
Node IDs are generated as Label:filePath (e.g., Function:src/foo.ts:bar),
so forward slashes are expected in legitimate IDs. The over-tightened
regex was dropping all path-based IDs from Cypher queries.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-23 04:45:09 -05:00
jreakin
9f14edc226 fix(web): security hardening — Cypher injection, XSS, readOnly, prepared statements 
- DOMPurify.sanitize() on mermaid SVG in ProcessFlowModal
- validLabel()/validRelType() guards on all Cypher interpolation in tools.ts
- isSafeId() strict regex in ProcessesPanel (no spaces/slashes/metacharacters)
- executeQuery defaults readOnly=true (rejects CREATE/DELETE/DROP/etc.)
- Singleton promise for initLbug (prevents concurrent init races)
- Prepared statements for relation inserts (batched by label pair)
- executeWithReusedStatement for enrichment updates
- try/finally on all PreparedStatement cleanup
- 99 security guard tests (validLabel, validRelType, isSafeId, readOnly regex)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-23 04:45:09 -05:00
jreakin
ee78ebe64a test: add positive and negative tests for all 4 bug fixes 
16 tests covering the data structures and logic underlying each fix:

createKnowledgeGraph (loadServerGraph data flow):
  + nodes stored correctly via addNode
  + relationships stored correctly via addRelationship
  + deduplication by ID
  + nodeCount reflects unique count
  - empty graph has zero counts
  - relationships with non-existent nodes still stored

loadServerGraph data flow:
  + server data reconstructs into valid KnowledgeGraph
  + fileContents Map built from server entries
  - empty server data produces empty graph
  - fileContents replaces (not accumulates) on reload

BM25 index argument type:
  + Map<string, string> has entries() for BM25
  - KnowledgeGraph does NOT have entries() (the original bug)

Highlight clearing:
  + clearing Set produces empty set
  + independent highlight sources cleared separately
  - clearing highlights doesn't affect node selection
  - toggling AI ON doesn't clear process highlights

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-23 03:48:27 -05:00