Conversation
publish: 백준 Baekjoon 알고리즘 문제풀이 팁 for NodeJS, JavaScript
publish: 백준 Baekjoon 알고리즘 문제풀이 팁 for NodeJS, JavaScript
Storybook MCP 로 컴포넌트 문서화를 자동화하고 AI Context로 활용하기
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! 이 Pull Request는 이미지 처리 플러그인의 기능을 확장하고, 블로그 게시물 파일 구조를 표준화하며, 새로운 문서와 기술 블로그 게시물을 추가하여 프로젝트의 전반적인 유지보수성과 확장성을 향상시키는 데 중점을 둡니다. 이미지 Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This PR introduces a new technical blog post detailing the construction of a dynamic constellation node system using trigonometry and the Render Props pattern. It also refactors existing post file structures to use index.md for improved URL management and enhances the image processing plugin to handle the width attribute more flexibly. However, a critical security vulnerability has been identified: multiple Cross-Site Scripting (XSS) vulnerabilities exist in the .vitepress/plugins/markdown-picture.ts file. These arise from manually constructing HTML strings with untrusted data from markdown files (such as image src, alt, and width attributes) without proper escaping, which could allow an attacker to execute arbitrary JavaScript. It is highly recommended to implement a robust HTML escaping utility for all data inserted into HTML templates to mitigate this risk. Additionally, there are a few minor code-related suggestions to consider.
| // 외부 URL이거나 svg, gif는 picture 태그로 변환하지 않음 | ||
| if (src.startsWith("http") || src.endsWith(".svg") || src.endsWith(".gif")) { | ||
| return `<img src="${src}" alt="${safeAlt}"${safeAttrs} loading="lazy" />`; | ||
| return `<img src="${src}" alt="${safeAlt}"${safeAttrs ? " " + safeAttrs : ""} loading="lazy" />`; |
There was a problem hiding this comment.
The src, alt, and safeAttrs variables are inserted directly into the HTML string without any escaping or sanitization. This can lead to Cross-Site Scripting (XSS) if these values contain malicious content (e.g., a double quote followed by an event handler like " onerror="alert(1)"). Since these values originate from markdown files, they should be properly escaped before being rendered into HTML.
| const pictureAttr = pictureStyle ? ` style="${pictureStyle}"` : ""; | ||
| return `<picture${pictureAttr}> |
There was a problem hiding this comment.
The pictureAttr (which contains pictureStyle) is injected directly into the <picture> tag. pictureStyle is derived from the width attribute in additionalAttrs. If an attacker provides a malicious width value (e.g., width="100%; background-image: url(javascript:alert(1))"), it could lead to XSS or other injection attacks. CSS values should be sanitized or strictly validated.
| const additionalAttrs = token.attrs! | ||
| .filter(([name]) => name !== "src" && name !== "alt") | ||
| .map(([name, value]) => `${name}="${value}"`) | ||
| .join(" "); |
There was a problem hiding this comment.
Attributes extracted from the markdown token are concatenated into a string without escaping their values. This allows an attacker to inject arbitrary HTML attributes or break out of the attribute context. All attribute values should be escaped before being included in the additionalAttrs string.
| const additionalAttrs = token.attrs! | |
| .filter(([name]) => name !== "src" && name !== "alt") | |
| .map(([name, value]) => `${name}="${value}"`) | |
| .join(" "); | |
| const additionalAttrs = token.attrs! | |
| .filter(([name]) => name !== "src" && name !== "alt") | |
| .map(([name, value]) => `${name}="${md.utils.escapeHtml(value)}"`) | |
| .join(" "); |
| @@ -0,0 +1,57 @@ | |||
| # ToothlessDev Blog | |||
There was a problem hiding this comment.
이 GEMINI.md 파일은 프로젝트의 README와 내용이 동일해 보입니다. 이번 PR의 주된 내용인 새 블로그 포스트와는 관련이 없어 보이는데, 의도적으로 추가된 파일이 맞나요? 레포지토리의 깔끔한 관리를 위해 불필요한 파일이라면 제거하는 것을 고려해볼 수 있겠습니다.
| @@ -0,0 +1,218 @@ | |||
| --- | |||
| title: "정적 좌표 지옥에서 탈출한 동적 별자리 노드 시스템 구축기" | |||
| createdAt: "2026-03-02" | |||
There was a problem hiding this comment.
포스트의 생성 날짜(createdAt)가 미래 시점인 2026-03-02로 설정되어 있습니다. 오타이거나 플레이스홀더인 것 같습니다. 현재 날짜나 실제 포스트 작성일로 수정하는 것이 좋겠습니다.
| createdAt: "2026-03-02" | |
| createdAt: "2024-03-02" |
| angle, | ||
| offsetArray, | ||
| offsetStartX, | ||
| }: CreatStarNodesArgs) { |
There was a problem hiding this comment.
CreatStarNodesArgs 타입 이름에 오타가 있습니다. CreateStarNodesArgs로 수정하는 것이 좋아 보입니다.
| }: CreatStarNodesArgs) { | |
| }: CreateStarNodesArgs) { |
2 participants
No description provided.