Start creating v3 of the product#3
Conversation
Entelligence AI Vulnerability ScannerStatus: No security vulnerabilities found Your code passed our comprehensive security analysis. Analyzed 4 files in total |
Review Summary❌ Rejected Comments (5)
🏷️ Draft Comments (3)
🔍 Comments beyond diff scope (1)
|
WalkthroughThis PR introduces several service-level improvements across the API v2 codebase. Key enhancements include adding a caching layer for team billing statistics to optimize dashboard performance, implementing user metadata fetching in booking responses, and improving the Zoom OAuth integration with proper content-type headers. Error logging capabilities were enhanced in the API key service with better debugging information and documentation for key rotation flows. Additionally, a minor documentation update adds a closing acknowledgment to the README. Changes
Sequence DiagramThis diagram shows the interactions between components: sequenceDiagram
participant BookingService
participant UsersRepository
participant Database
Note over BookingService: Processing bookings in loop
loop For each booking
BookingService->>BookingService: Check if booking.userId exists
alt booking.userId exists
BookingService->>UsersRepository: findById(booking.userId)
activate UsersRepository
UsersRepository->>Database: Query user by ID
Database-->>UsersRepository: User data
UsersRepository-->>BookingService: bookingUser with metadata
deactivate UsersRepository
else no userId
BookingService->>BookingService: Set bookingUser = null
end
BookingService->>BookingService: Format booking object
Note over BookingService: Includes eventType, startTime,<br/>endTime, absentHost, and<br/>NEW: userMetadata
BookingService->>BookingService: Add userMetadata from bookingUser
Note right of BookingService: Enriches booking with<br/>latest user metadata
end
🔗 Cross-Repository Impact AnalysisEnable automatic detection of breaking changes across your dependent repositories. → Set up now Learn more about Cross-Repository AnalysisWhat It Does
How to Enable
Benefits
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
![entelligence-ai-pr-reviews[bot]](https://avatars.githubusercontent.com/in/932812?s=60&v=4){kind=small}
| const { client_id, client_secret } = await this.getZoomAppKeys(); | ||
| const redirectUri = encodeURI(this.redirectUri); | ||
| const authHeader = `Basic ${Buffer.from(`${client_id}:${client_secret}`).toString("base64")}`; | ||
|
|
||
| // Exchange authorization code for access token | ||
| const result = await fetch( | ||
| `https://zoom.us/oauth/token?grant_type=authorization_code&code=${code}&redirect_uri=${redirectUri}`, | ||
| { | ||
| method: "POST", | ||
| headers: { | ||
| Authorization: authHeader, | ||
| "Content-Type": "application/x-www-form-urlencoded", | ||
| }, | ||
| } | ||
| ); |
There was a problem hiding this comment.
security: code parameter in connectZoomApp is used directly in the Zoom OAuth token request URL without validation, allowing an attacker to inject malicious values or perform SSRF if code is attacker-controlled.
🤖 AI Agent Prompt for Cursor/Windsurf
📋 Copy this prompt to your AI coding assistant (Cursor, Windsurf, etc.) to get help fixing this issue
In apps/api/v2/src/modules/conferencing/services/zoom-video.service.ts, lines 61-76, the `code` parameter is used directly in the OAuth token request URL without validation, which could allow SSRF or injection if attacker-controlled. Add strict validation to ensure `code` only contains safe characters (e.g., alphanumeric, dash, underscore) and reject any invalid input before using it in the URL.
📝 Committable Code Suggestion
‼️ Ensure you review the code suggestion before committing it to the branch. Make sure it replaces the highlighted code, contains no missing lines, and has no issues with indentation.
| const { client_id, client_secret } = await this.getZoomAppKeys(); | |
| const redirectUri = encodeURI(this.redirectUri); | |
| const authHeader = `Basic ${Buffer.from(`${client_id}:${client_secret}`).toString("base64")}`; | |
| // Exchange authorization code for access token | |
| const result = await fetch( | |
| `https://zoom.us/oauth/token?grant_type=authorization_code&code=${code}&redirect_uri=${redirectUri}`, | |
| { | |
| method: "POST", | |
| headers: { | |
| Authorization: authHeader, | |
| "Content-Type": "application/x-www-form-urlencoded", | |
| }, | |
| } | |
| ); | |
| if (!/^[A-Za-z0-9\-_]+$/.test(code)) { | |
| throw new BadRequestException("Invalid authorization code format."); | |
| } | |
| const result = await fetch( | |
| `https://zoom.us/oauth/token?grant_type=authorization_code&code=${code}&redirect_uri=${redirectUri}`, | |
| { | |
| method: "POST", | |
| headers: { | |
| Authorization: authHeader, | |
| "Content-Type": "application/x-www-form-urlencoded", | |
| }, | |
| } | |
| ); |
1 participant
EntelligenceAI PR Summary
This PR enhances API v2 services with performance optimizations, improved error handling, and OAuth compliance fixes.