Closed
Conversation
Signed-off-by: Zhu Chenrui <boomzero_zcr@outlook.com>
(cherry picked from commit c7137ff)
Signed-off-by: Zhu Chenrui <boomzero_zcr@outlook.com> (cherry picked from commit 07d7590) Update feature.yml Signed-off-by: Zhu Chenrui <boomzero_zcr@outlook.com> (cherry picked from commit 1a99430) Update docs.yml Signed-off-by: Zhu Chenrui <boomzero_zcr@outlook.com> (cherry picked from commit 6017bcf)
Signed-off-by: Shan Wenxiao <seanoj_noreply@yeah.net>
…ns[bot] This prevents infinite loops where the bot commits version updates, which triggers the workflow again, causing another commit. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
The last-commit-author guard now only exits for non-edited events, so PR title/body changes still update Update.json metadata even when the branch tip is a github-actions[bot] commit. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Exclude all bot actors (not just github-actions[bot]) from triggering the UpdateVersion workflow, preventing loops from AI code review bots. Allow edited events through the script-level guard so PR title/body changes still update Update.json metadata. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Update to release 3.2.2
Reviewer's GuideAdds a reusable contest problem list fetcher and wires it into the problem switcher so that the list is populated from localStorage and can be refreshed on demand via a new UI control. Sequence diagram for contest problem list refresh via problem switchersequenceDiagram
actor User
participant ProblemSwitcherUI
participant GetContestProblemList
participant XMOJServer
participant DOMParser
participant localStorage
participant BrowserLocation
User->>ProblemSwitcherUI: Click_refresh_link
ProblemSwitcherUI->>GetContestProblemList: GetContestProblemList(true)
activate GetContestProblemList
GetContestProblemList->>XMOJServer: fetch(contest_php_with_cid)
activate XMOJServer
XMOJServer-->>GetContestProblemList: HTML_contest_page
deactivate XMOJServer
GetContestProblemList->>DOMParser: parseFromString(html, text_html)
activate DOMParser
DOMParser-->>GetContestProblemList: contest_DOM
deactivate DOMParser
GetContestProblemList->>GetContestProblemList: extract_problem_rows
GetContestProblemList->>localStorage: setItem(UserScript_Contest_cid_ProblemList, problemList_json)
alt RefreshList_is_true
GetContestProblemList->>BrowserLocation: reload()
end
deactivate GetContestProblemList
File-Level Changes
Possibly linked issues
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
hendragon-bot
bot
added
the
user-script
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 2 security issues, and left some high level feedback:
Security issues:
- User controlled data in methods like
innerHTML,outerHTMLordocument.writeis an anti-pattern that can lead to XSS vulnerabilities (link) - User controlled data in a
problemSwitcher.innerHTMLis an anti-pattern that can lead to XSS vulnerabilities (link)
General comments:
- The call to
unsafeWindow.GetContestProblemList(false)inmainis not awaited, soContestProblemList = localStorage.getItem(...)will likely run before the async fetch completes; consider makingGetContestProblemListreturn the list andawaitit instead of relying on localStorage side effects. - The new
GetContestProblemListis exposed onunsafeWindowand triggered via an inlineonclickstring; wiring the refresh link withaddEventListenerand a locally scoped handler will avoid global pollution and string-based event handlers. - The contest URL (
https://www.xmoj.tech/contest.php?cid=+SearchParams.get("cid")) is now duplicated betweenmainandGetContestProblemList; consider centralizing this into a helper or constant to avoid divergence if the URL format changes.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- The call to `unsafeWindow.GetContestProblemList(false)` in `main` is not awaited, so `ContestProblemList = localStorage.getItem(...)` will likely run before the async fetch completes; consider making `GetContestProblemList` return the list and `await` it instead of relying on localStorage side effects.
- The new `GetContestProblemList` is exposed on `unsafeWindow` and triggered via an inline `onclick` string; wiring the refresh link with `addEventListener` and a locally scoped handler will avoid global pollution and string-based event handlers.
- The contest URL (`https://www.xmoj.tech/contest.php?cid=` + `SearchParams.get("cid")`) is now duplicated between `main` and `GetContestProblemList`; consider centralizing this into a helper or constant to avoid divergence if the URL format changes.
## Individual Comments
### Comment 1
<location path="XMOJ.user.js" line_range="2320" />
<code_context>
problemSwitcher.innerHTML += `<a href="javascript:void(0)" onclick="GetContestProblemList(true)" title="刷新列表" class="mb-2" style="text-align: center;" active>刷新</a>`;
</code_context>
<issue_to_address>
**security (javascript.browser.security.insecure-document-method):** User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities
*Source: opengrep*
</issue_to_address>
### Comment 2
<location path="XMOJ.user.js" line_range="2320" />
<code_context>
problemSwitcher.innerHTML += `<a href="javascript:void(0)" onclick="GetContestProblemList(true)" title="刷新列表" class="mb-2" style="text-align: center;" active>刷新</a>`;
</code_context>
<issue_to_address>
**security (javascript.browser.security.insecure-innerhtml):** User controlled data in a `problemSwitcher.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities
*Source: opengrep*
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
| problemSwitcher.style.flexDirection = "column"; | ||
|
|
||
| let problemList = JSON.parse(ContestProblemList); | ||
| problemSwitcher.innerHTML += `<a href="javascript:void(0)" onclick="GetContestProblemList(true)" title="刷新列表" class="mb-2" style="text-align: center;" active>刷新</a>`; |
There was a problem hiding this comment.
security (javascript.browser.security.insecure-document-method): User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities
Source: opengrep
| problemSwitcher.style.flexDirection = "column"; | ||
|
|
||
| let problemList = JSON.parse(ContestProblemList); | ||
| problemSwitcher.innerHTML += `<a href="javascript:void(0)" onclick="GetContestProblemList(true)" title="刷新列表" class="mb-2" style="text-align: center;" active>刷新</a>`; |
There was a problem hiding this comment.
security (javascript.browser.security.insecure-innerhtml): User controlled data in a problemSwitcher.innerHTML is an anti-pattern that can lead to XSS vulnerabilities
Source: opengrep
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
2 issues found across 2 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="XMOJ.user.js">
<violation number="1" location="XMOJ.user.js:2296">
P2: Await the async `GetContestProblemList` call before reading from localStorage, otherwise the list can still be null and `JSON.parse` will throw.</violation>
</file>
<file name="Update.json">
<violation number="1" location="Update.json:2940">
P2: Do not manually edit Update.json version keys; version updates are fully automated and must stay in sync with the workflow.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
| localStorage.setItem("UserScript-Contest-" + SearchParams.get("cid") + "-ProblemList", JSON.stringify(problemList)); | ||
| ContestProblemList = JSON.stringify(problemList); | ||
| } | ||
| unsafeWindow.GetContestProblemList(false); |
There was a problem hiding this comment.
P2: Await the async GetContestProblemList call before reading from localStorage, otherwise the list can still be null and JSON.parse will throw.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At XMOJ.user.js, line 2296:
<comment>Await the async `GetContestProblemList` call before reading from localStorage, otherwise the list can still be null and `JSON.parse` will throw.</comment>
<file context>
@@ -2270,22 +2293,8 @@ async function main() {
- localStorage.setItem("UserScript-Contest-" + SearchParams.get("cid") + "-ProblemList", JSON.stringify(problemList));
- ContestProblemList = JSON.stringify(problemList);
- }
+ unsafeWindow.GetContestProblemList(false);
+ ContestProblemList = localStorage.getItem("UserScript-Contest-" + SearchParams.get("cid") + "-ProblemList");
}
</file context>
Suggested change
| unsafeWindow.GetContestProblemList(false); | |
| await unsafeWindow.GetContestProblemList(false); |
Updated version from 3.3.1 to 3.4.0 in Update.json. Signed-off-by: zsTree <wa2025666@gmail.com>
Signed-off-by: zsTree <wa2025666@gmail.com>
Signed-off-by: zsTree <wa2025666@gmail.com>
Signed-off-by: zsTree <wa2025666@gmail.com>
Signed-off-by: zsTree <wa2025666@gmail.com>
Signed-off-by: zsTree <wa2025666@gmail.com>
Signed-off-by: zsTree <wa2025666@gmail.com>
Signed-off-by: zsTree <wa2025666@gmail.com>
Member
Author
Member
|
请不要自己修改版本号，自动程序会帮你修改版本号
At 2026-03-13 00:19:42, "zsTree" ***@***.***> wrote:
def-WA2025 left a comment (XMOJ-Script-dev/XMOJ-Script#931)
@boomzero
—
Reply to this email directly, view it on GitHub, or unsubscribe.
You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>
|
Member
|
这样的话版本管理会很乱
Message ID: ***@***.***>
|
Member
|
请仔细审查代码审核机器人的意见，特别是第二条关于版本管理的意见。
At 2026-03-13 00:19:42, "zsTree" ***@***.***> wrote:
def-WA2025 left a comment (XMOJ-Script-dev/XMOJ-Script#931)
@boomzero
—
Reply to this email directly, view it on GitHub, or unsubscribe.
You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>
|
Member
|
版本号应该是3.3.2吧（？ |
boomzero
requested changes
Mar 13, 2026
| "Prerelease": true, | ||
| "UpdateContents": [ | ||
| { | ||
| "PR": 924, |
Member
Author
|
似乎没看到有3.3.1版本？ |
Member
Author
|
ooo PR里面找到了 |
Member
Author
|
PR里找到了 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR aim to accomplish?
Fix *EX problems not display.
How does this PR accomplish the above?
Update list when click the refresh button. (The refresh button is located at the top of the problem switcher)
By submitting this pull request, I confirm the following:
git rebase)Summary by Sourcery
Ensure the contest problem switcher reflects the latest problem list and can be manually refreshed from the UI.
Bug Fixes:
Enhancements:
Summary by cubic
Fixes the contest problem switcher not updating by adding a manual refresh and a shared fetcher that pulls the latest problem list. The switcher now reflects current contest problems.
Bug Fixes
GetContestProblemList(refresh)onunsafeWindowto fetch/parse contest problems, cache inlocalStorage, and optionally reload.GetContestProblemList(true).GetContestProblemList(false).Dependencies
3.4.0inpackage.json.Update.jsonprerelease entry for3.4.0with notes and timestamp.1.10.0.Written for commit 9c5a57d. Summary will update on new commits.