[AI] What to change: The sync between color chosen at the Branding page under Sett... - #215
Open
burkongla wants to merge 1 commit into
Open
Conversation
…age under Sett... Task: a1a4a7dd Source: slack Requested by: U04E9DZ5ELF
✅ Deploy Preview for githelp-support ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated PR
Task: What to change: The sync between color chosen at the Branding page under Sett...
Description: What to change: The sync between color chosen at the Branding page under Settings for Admin, and the color used in the dp icon for the project in question.
• Make sure that the “Primary color” chosen under the Branding page, is synced with the color shown in the dp icon for the project, if there is no logo image uploaded for the project.
Do not change: Anything else than what is listed.
Acceptance criteria: When all points listed under “Description and specific values” are implemented the task is done
Source: slack
Requested by: U04E9DZ5ELF
Classification: visual
Changes
Sync the project 'dp icon' (avatar fallback shown when no logo is uploaded) with the 'Primary color' saved on the Branding settings page. Currently the fallback uses hardcoded colors (bg-brand-primary, bg-[#3c2ec5], or a hash-based color via getAvatarColorHexForId) instead of brandingData.primary_color, which is already fetched by useProjectBranding (select *) in all affected views.
Security Review
Status: warn
No dependency changes (package.json/lock untouched, npm audit skipped) and no secrets, auth, or injection-into-HTML issues. However, the diff wires an unvalidated free-text DB field (primary_color) into inline style attributes on public, cross-tenant pages, enabling CSS injection via SSR — validate the hex format at render, save, and database layers.
Warnings:
brandingData.primary_color(a free-text DB value set by project owners in src/app/settings/branding/page.tsx line 138 — plain text Input, no format validation) is injected into inline style attributes on public support pages viewed by other users. React does not sanitize style values during SSR: a value likered;background-image:url(https://evil.example/beacon)serializes into the style attribute of the server-rendered HTML, enabling cross-tenant CSS injection (tracking beacons, UI spoofing/defacement of the support widget). Same pattern at lines 480 and 532, src/app/support/chat/page.tsx:647, src/app/support/get-support/page.tsx:73, src/app/projects/[id]/page.tsx:160, and src/components/layout/top-bar.tsx:64. Not script-executing XSS (CSS can't run JS in modern browsers), so medium rather than high.updateBranding.mutateAsync— this is the write path that makes the CSS-injection issue above reachable. The hiddentype="color"input is constrained, but the visible text Input is not.🤖 Generated by githelp-support agent team