fix(privacy): sanitize review comments before DB write#73
Conversation
AddReviewButton and AddReviewButtonProfessor were writing user comments directly to the reviews table without calling enhancedSanitizeContent. This meant emails, phone numbers, student IDs, names, and other PII typed into reviews would persist in the database verbatim, defeating the anonymization design. Wire enhancedSanitizeContent into both submission paths so PII is stripped before the Supabase insert/update.
|
@roshanraj9136 is attempting to deploy a commit to the OpenLake_Website Team on Vercel. A member of the Team first needs to authorize it. |
|
Warning Review limit reached
More reviews will be available in 34 minutes and 16 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more credits in the billing tab to continue. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Problem
AddReviewButtonandAddReviewButtonProfessorwrite user-submitted comments directly to thereviewstable without sanitization. If a student types their email, phone number, name, or student ID into a review, that PII is stored verbatim — defeating the anonymization design.enhancedSanitizeContentalready exists insrc/lib/anonymization.tsand handles all these cases, but it was never called on the write path.Fix
Import and call
enhancedSanitizeContent(comment)before the Supabase.update()in both components.Files changed (2)
src/components/courses/AddReviewButton.tsxsrc/components/professors/AddReviewButtonProfessor.tsxVerified
tsc --noEmitclean