Files
prowler/ui/actions/finding-groups/finding-groups.ts
T
Alan Buscaglia 9c1dba9295 fix(ui): security and crash fixes for findings grouped view
- Fix SSRF path traversal: encode checkId with encodeURIComponent in
  getFindingGroupResources and getLatestFindingGroupResources URL paths
- Fix SSR crash: add isMounted guard for createPortal(document.body) in
  InlineResourceContainer to prevent document access during server render
- Fix invalid Tailwind: replace mt-[-10] (no unit) with -mt-2.5 scale token
- Fix unbounded page[size]: cap at 500 via Math.min in URL builder as
  defense-in-depth alongside existing chunking
- Fix pageRef race condition: move page counter increment inside fetchPage
  after successful non-aborted response, remove redundant pre-set from
  refresh() to prevent permanent page skip on concurrent abort

26 tests across 4 test suites (2 new, 2 extended). All passing.
TypeScript: 0 errors in changed files. ESLint: 0 errors.
Claude Code validation: PASSED.
Pre-existing healthcheck failures (.next/types, @codemirror) unrelated.
2026-03-30 15:10:04 +02:00

147 lines
4.0 KiB
TypeScript

"use server";
import { redirect } from "next/navigation";
import { apiBaseUrl, getAuthHeaders } from "@/lib";
import { appendSanitizedProviderFilters } from "@/lib/provider-filters";
import { handleApiResponse } from "@/lib/server-actions-helper";
/**
* Maps filter[search] to filter[check_title__icontains] for finding-groups.
* The finding-groups endpoint supports check_title__icontains for substring
* matching on the human-readable check title displayed in the table.
*/
function mapSearchFilter(
filters: Record<string, string | string[] | undefined>,
): Record<string, string | string[] | undefined> {
const mapped = { ...filters };
const searchValue = mapped["filter[search]"];
if (searchValue) {
mapped["filter[check_title__icontains]"] = searchValue;
delete mapped["filter[search]"];
}
return mapped;
}
export const getFindingGroups = async ({
page = 1,
pageSize = 10,
sort = "",
filters = {},
}) => {
const headers = await getAuthHeaders({ contentType: false });
if (isNaN(Number(page)) || page < 1) redirect("/findings");
const url = new URL(`${apiBaseUrl}/finding-groups`);
if (page) url.searchParams.append("page[number]", page.toString());
if (pageSize) url.searchParams.append("page[size]", pageSize.toString());
if (sort) url.searchParams.append("sort", sort);
appendSanitizedProviderFilters(url, mapSearchFilter(filters));
try {
const response = await fetch(url.toString(), { headers });
return handleApiResponse(response);
} catch (error) {
console.error("Error fetching finding groups:", error);
return undefined;
}
};
export const getLatestFindingGroups = async ({
page = 1,
pageSize = 10,
sort = "",
filters = {},
}) => {
const headers = await getAuthHeaders({ contentType: false });
if (isNaN(Number(page)) || page < 1) redirect("/findings");
const url = new URL(`${apiBaseUrl}/finding-groups/latest`);
if (page) url.searchParams.append("page[number]", page.toString());
if (pageSize) url.searchParams.append("page[size]", pageSize.toString());
if (sort) url.searchParams.append("sort", sort);
appendSanitizedProviderFilters(url, mapSearchFilter(filters));
try {
const response = await fetch(url.toString(), { headers });
return handleApiResponse(response);
} catch (error) {
console.error("Error fetching latest finding groups:", error);
return undefined;
}
};
export const getFindingGroupResources = async ({
checkId,
page = 1,
pageSize = 20,
filters = {},
}: {
checkId: string;
page?: number;
pageSize?: number;
filters?: Record<string, string | string[] | undefined>;
}) => {
const headers = await getAuthHeaders({ contentType: false });
const url = new URL(
`${apiBaseUrl}/finding-groups/${encodeURIComponent(checkId)}/resources`,
);
if (page) url.searchParams.append("page[number]", page.toString());
if (pageSize) url.searchParams.append("page[size]", pageSize.toString());
appendSanitizedProviderFilters(url, filters);
try {
const response = await fetch(url.toString(), {
headers,
});
return handleApiResponse(response);
} catch (error) {
console.error("Error fetching finding group resources:", error);
return undefined;
}
};
export const getLatestFindingGroupResources = async ({
checkId,
page = 1,
pageSize = 20,
filters = {},
}: {
checkId: string;
page?: number;
pageSize?: number;
filters?: Record<string, string | string[] | undefined>;
}) => {
const headers = await getAuthHeaders({ contentType: false });
const url = new URL(
`${apiBaseUrl}/finding-groups/latest/${encodeURIComponent(checkId)}/resources`,
);
if (page) url.searchParams.append("page[number]", page.toString());
if (pageSize) url.searchParams.append("page[size]", pageSize.toString());
appendSanitizedProviderFilters(url, filters);
try {
const response = await fetch(url.toString(), {
headers,
});
return handleApiResponse(response);
} catch (error) {
console.error("Error fetching latest finding group resources:", error);
return undefined;
}
};