Conversation
Code Review Completed! 🔥The code review was successfully completed based on your current configurations. Kody Guide: Usage and ConfigurationInteracting with Kody
Current Kody ConfigurationReview OptionsThe following review options are enabled or disabled:
|
|
Thanks for opening this, but we'd appreciate a little more information. Could you update it with more details? |
📝 WalkthroughWalkthroughThe call view now parses form data safely. Valid ChangesCall form rendering
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Web/Resgrid.Web/Areas/User/Views/Dispatch/ViewCall.cshtml`:
- Around line 977-980: Update the formRender invocation in the
Array.isArray(callFormFields) branch to protect API-writable callFormData by
enabling sanitizerOptions and disabling HTML labels, or by allowlisting and
sanitizing the parsed payload before rendering. Ensure labels and paragraph
content are treated as plain text rather than rendered HTML.
- Around line 985-987: Update the success handler’s rendered-form selector to
target `#fb-template` .rendered-form and include button elements alongside input,
textarea, and select, ensuring all controls are made read-only or disabled.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 4c52c7c5-6958-4e72-aa2f-c318fd7ddaa1
📒 Files selected for processing (1)
Web/Resgrid.Web/Areas/User/Views/Dispatch/ViewCall.cshtml
| var callFormFields = null; | ||
| try { | ||
| callFormFields = JSON.parse(callFormData); | ||
| } catch (e) { } |
There was a problem hiding this comment.
The empty catch block on line 975 swallows the JSON.parse exception silently, leaving no diagnostic trail for malformed CallFormData despite Rule [28] requiring caught exceptions be logged with context. Add a minimal console.warn with the callId inside the catch block.
Kody rule violation: Avoid empty catch blocks
Prompt for LLM
File Web/Resgrid.Web/Areas/User/Views/Dispatch/ViewCall.cshtml:
Line 975:
The empty catch block on line 975 swallows the JSON.parse exception silently, leaving no diagnostic trail for malformed CallFormData despite Rule [28] requiring caught exceptions be logged with context. Add a minimal console.warn with the callId inside the catch block.
Talk to Kody by mentioning @kody
Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.
| } catch (e) { } | ||
|
|
||
| if (Array.isArray(callFormFields)) { | ||
| // form-render inserts label/option/description content as HTML and its sanitizer is a |
There was a problem hiding this comment.
The var declaration of newCallForm violates Rule [37] which requires const/let for variable declarations. Since newCallForm is assigned once and never reassigned, replace var with const.
Kody rule violation: Always use const and let
Prompt for LLM
File Web/Resgrid.Web/Areas/User/Views/Dispatch/ViewCall.cshtml:
Line 978:
The var declaration of newCallForm violates Rule [37] which requires const/let for variable declarations. Since newCallForm is assigned once and never reassigned, replace var with const.
Talk to Kody by mentioning @kody
Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.
|
Approve |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
2 participants
PR Description
Fixes the "View Call" page to gracefully handle non-formBuilder call form data
Previously, the View Call page always passed
CallFormDatadirectly to theformRenderplugin expecting valid formBuilder JSON. When the field contained plain text (e.g., from older or external API clients that wrote free text such as a "Submitted..." message),formRenderwould fail because it could not parse the data as JSON.Changes
CallFormDatais now serialized via JSON.NET with HTML-escape handling and safely null-coalesced to an empty string, rather than being embedded raw inside a JavaScript string literal (which was vulnerable to quote/character escaping issues).formRenderwhen the result is a valid JSON array (proper formBuilder data).CallFormDatais not valid formBuilder JSON but still contains text, it is now displayed as plain read-only text inside the container instead of causing a rendering error.Functional Impact
Users can now reliably view calls whose form data was authored by older or third-party clients that stored plain text rather than structured form definitions, eliminating the form-rendering failure on the View Call screen.
Summary by CodeRabbit