Backend and Frontend Improvements for Semgrep Compliance and Enhanced Security

[OhmSpectator]

Description

This PR addresses two distinct improvements aimed at satisfying semgrep analysis. The first change, in the backend, involves a refactor of the region search query. This refactor was necessary to address false positives raised by semgrep regarding potential Sequelize injection points. By using separate arrays for regex and substring match case statements and joining them with SQL's '+' operator, we have simplified the query construction and eliminated the security concern. The second change is in the frontend, specifically in BreadcrumbNavigation.jsx and HierarchySwitcher.jsx. The formatting of error log messages has been revised to use constant values for format strings, addressing a potential security concern where an attacker could forge log messages.

Related Issues

None

How Was This Tested?

Tests were conducted to ensure the backend changes did not affect the functionality of the region search feature.

Checklist

Before submitting your PR, please review the following:

• Commit messages follow the standard template.
• All commits are signed.
• Related issues are mentioned in the description above.
• I have followed the project's directory structure.
• Linter checks have been passed.

Summary by CodeRabbit

• Refactor
  • Improved search functionality with more efficient query handling in the region search feature.
  • Updated error message formatting for enhanced clarity in the Breadcrumb Navigation and Hierarchy Switcher components.

[coderabbitai]

Walkthrough

The recent updates involve refactoring error logging and enhancing the search functionality. In the backend, regionController.js now uses arrays to manage regex and substring matching for region searches, streamlining the SQL query construction. In the frontend, both BreadcrumbNavigation.jsx and HierarchySwitcher.jsx components have altered their error logging format, shifting from template literals to formatted strings with placeholders for variable insertion, ensuring consistency and possibly improving performance.

Changes

File Path	Change Summary
backend/src/controllers/regionController.js	Introduced arrays for regex and substring matching in searchRegions function to optimize SQL query construction.
frontend/src/components/BreadcrumbNavigation.jsx frontend/src/components/HierarchySwitcher.jsx	Modified error logging to use formatted strings with %d placeholders for variable insertion.

Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on X ?

---

Tips

Chat with CodeRabbit Bot (@coderabbitai)

• You can reply to a review comment made by CodeRabbit.
• You can tag CodeRabbit on specific lines of code or files in the PR by tagging @coderabbitai in a comment.
• You can tag @coderabbitai in a PR comment and ask one-off questions about the PR and the codebase. Use quoted replies to pass the context for follow-up questions.

CodeRabbit Commands (invoked as PR comments)

• @coderabbitai pause to pause the reviews on a PR.
• @coderabbitai resume to resume the paused reviews.
• @coderabbitai review to trigger a review. This is useful when automatic reviews are disabled for the repository.
• @coderabbitai resolve resolve all the CodeRabbit review comments.
• @coderabbitai help to get help.

Additionally, you can add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.

CodeRabbit Configration File (.coderabbit.yaml)

• You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
• The JSON schema for the configuration file is available here.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/coderabbit-overrides.v2.json

[sweep-ai]

Apply Sweep Rules to your PR?

• Apply: All new business logic should have corresponding unit tests.
• Apply: Refactor large functions to be more modular.
• Apply: Add docstrings to all functions and file headers.
• Apply: In the PR description, provide the Issue number that your PR fixes in a form Fixes #<Issue Number>
• Apply: Make changes only in the directory you are working on (frontend, backend, or deployment).
• Apply: For JavaScript (used in frontend and backend), follow the Airbnb JavaScript Style Guide
• Apply: For Python (used in deployment scripts), use Black
• Apply: Follow this format for all commit messages:

<Type>: <Topic>.

<Description>

[Issue: #<GitHub Issue Number>]

Type can be one of the following:

• front: Frontend
• back: Backend
• deploy: Deployment
  Or leave it blank if the commit is not specific to any of the above.
  Ensure the commit message is concise yet descriptive.
  If the commit fixes an issue, add the issue number in the commit message.

[coderabbitai]

Review Status

Actionable comments generated: 2

Configuration used: .coderabbit.yaml

Commits

Files that changed from the base of the PR and between d9945bc and 0391f2d.

Files selected for processing (3)

• backend/src/controllers/regionController.js (2 hunks)
• frontend/src/components/BreadcrumbNavigation.jsx (1 hunks)
• frontend/src/components/HierarchySwitcher.jsx (1 hunks)

Files skipped from review due to trivial changes (1)

• frontend/src/components/HierarchySwitcher.jsx

Additional comments: 1

backend/src/controllers/regionController.js (1)

• 39-44: The introduction of regexMatchCaseStatements and substringMatchCaseStatements arrays is a good practice to separate the logic of SQL query construction. However, ensure that the parameters inserted into the SQL query (:term${i}) are properly sanitized to prevent SQL injection vulnerabilities. Since the parameters are derived from user input (inputQuery), it is crucial that they are handled securely by Sequelize.

[coderabbitai]

Review Status

Actionable comments generated: 0

Configuration used: .coderabbit.yaml

Commits

Files that changed from the base of the PR and between d9945bc and d8df961.

Files selected for processing (3)

• backend/src/controllers/regionController.js (2 hunks)
• frontend/src/components/BreadcrumbNavigation.jsx (1 hunks)
• frontend/src/components/HierarchySwitcher.jsx (1 hunks)

Files skipped from review as they are similar to previous changes (3)

• backend/src/controllers/regionController.js
• frontend/src/components/BreadcrumbNavigation.jsx
• frontend/src/components/HierarchySwitcher.jsx