Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(frontend): Fix client-side validation for Agent Executor Block #8643

Merged
merged 3 commits into from
Nov 13, 2024

Conversation

majdyz
Copy link
Contributor

@majdyz majdyz commented Nov 13, 2024

AgentExecutorBlock stores the input data in the data field of the hardcoded value.
Currently, the AgentExecutorBlock is validating the metadata instead of the actual data.

image

Changes πŸ—οΈ

  • Fixed the false-negative validation error on the agent block executor.
  • Propagated the error of the validation error to the user instead of throwing a blanket Invalid credentials or inputs error.
  • Added open agent context menu item on the agent block executor.
image

Checklist πŸ“‹

For code changes:

  • I have clearly listed my changes in the PR description
  • I have made a test plan
  • I have tested my changes according to the test plan:
    • ...
Example test plan
  • Create from scratch and execute an agent with at least 3 blocks
  • Import an agent from file upload, and confirm it executes correctly
  • Upload agent to marketplace
  • Import an agent from marketplace and confirm it executes correctly
  • Edit an agent from monitor, and confirm it executes correctly

For configuration changes:

  • .env.example is updated or already compatible with my changes
  • docker-compose.yml is updated or already compatible with my changes
  • I have included a list of my configuration changes in the PR description (under Changes)
Examples of configuration changes
  • Changing ports
  • Adding new services that need to communicate with each other
  • Secrets or environment variable changes
  • New or infrastructure changes such as databases

@majdyz majdyz requested a review from a team as a code owner November 13, 2024 17:59
@github-actions github-actions bot added platform/frontend AutoGPT Platform - Front end platform/backend AutoGPT Platform - Back end labels Nov 13, 2024
Copy link

PR Reviewer Guide πŸ”

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 2 πŸ”΅πŸ”΅βšͺβšͺβšͺ
πŸ§ͺΒ No relevant tests
πŸ”’Β Security concerns

XSS vulnerability:
The PR introduces a new feature that opens URLs using window.open() with a flowID parameter. If the nodeFlowId is not properly sanitized, this could potentially lead to XSS attacks. The code should ensure that nodeFlowId only contains valid characters and is properly encoded before being used in the URL.

⚑ Recommended focus areas for review

Error Handling
The validation error message is now exposed directly to the user interface. Need to verify that no sensitive information could be leaked through validation error messages.

Security Check
The new 'Open agent' feature opens URLs directly using window.open(). Need to validate that the nodeFlowId is properly sanitized to prevent potential XSS attacks.

Copy link

netlify bot commented Nov 13, 2024

βœ… Deploy Preview for auto-gpt-docs ready!

Name Link
πŸ”¨ Latest commit 06b62b7
πŸ” Latest deploy log https://app.netlify.com/sites/auto-gpt-docs/deploys/6734e9184bd2c700091b2244
😎 Deploy Preview https://deploy-preview-8643--auto-gpt-docs.netlify.app
πŸ“± Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

Copy link

netlify bot commented Nov 13, 2024

βœ… Deploy Preview for auto-gpt-docs ready!

Name Link
πŸ”¨ Latest commit d5b8912
πŸ” Latest deploy log https://app.netlify.com/sites/auto-gpt-docs/deploys/6734e92a4bd2c700091b2ae9
😎 Deploy Preview https://deploy-preview-8643--auto-gpt-docs.netlify.app
πŸ“± Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

@aarushik93 aarushik93 merged commit 6724475 into dev Nov 13, 2024
15 checks passed
@aarushik93 aarushik93 deleted the zamilmajdy/center-initial-canvas-open-graph-option branch November 13, 2024 18:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
platform/backend AutoGPT Platform - Back end platform/frontend AutoGPT Platform - Front end Review effort [1-5]: 2 size/m
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants