[PROD] - Security fixes -> master #61

kkartunov · 2025-12-09T07:45:56Z

https://topcoder.atlassian.net/browse/PM-2614
https://topcoder.atlassian.net/browse/PM-2630
https://topcoder.atlassian.net/browse/PM-3327
https://topcoder.atlassian.net/browse/PS-473

Master -> security

Security -> dev

switch to new lib location -> dev

github-actions · 2025-12-09T07:46:09Z

.circleci/config.yml

+            branches:
+              only:
+                - develop
+                - security


[⚠️ design]
The branch filter for build-dev now includes security. Ensure this change aligns with your workflow requirements, as it will trigger development builds for the security branch, which may not be intended.

github-actions · 2025-12-09T07:46:16Z

src/services/ChallengePhaseService.js

+        if (_.isNil(successor.actualStartDate)) {
+          const desiredStartDate = new Date(currentEndDate);
+          const durationSeconds = Number(successor.duration);
+          if (!Number.isFinite(durationSeconds) || Number.isNaN(desiredStartDate.getTime())) {


[⚠️ correctness]
The check for Number.isFinite(durationSeconds) is good, but consider also checking if durationSeconds is a positive number to avoid setting negative durations.

github-actions · 2025-12-09T07:46:16Z

src/services/ChallengePhaseService.js

+          const durationSeconds = Number(successor.duration);
+          if (!Number.isFinite(durationSeconds) || Number.isNaN(desiredStartDate.getTime())) {
+            visited.add(successor.id);
+            queue.push(successorForQueue);


[⚠️ performance]
The logic here adds the successor to the queue even if durationSeconds is not finite or desiredStartDate is invalid. This could lead to unnecessary iterations. Consider revising the logic to avoid adding such successors to the queue.

github-actions · 2025-12-09T07:46:17Z

src/services/ChallengePhaseService.js

+            queue.push(successorForQueue);
+            continue;
+          }
+          const desiredEndDate = new Date(desiredStartDate.getTime() + durationSeconds * 1000);


[💡 correctness]
The calculation of desiredEndDate assumes durationSeconds is in seconds. Ensure that this assumption is documented or validated elsewhere in the code.

github-actions · 2025-12-09T07:46:17Z

src/services/ChallengePhaseService.js

+  const originalScheduledStartDate = challengePhase.scheduledStartDate;
+  const originalScheduledEndDate = challengePhase.scheduledEndDate;
+  const isReviewPhaseUpdate = isReviewPhase(data.name || challengePhase.name);
+  const shouldAttemptSuccessorRecalc =


[⚠️ correctness]
The condition isReviewPhaseUpdate && (data.duration || data.scheduledStartDate || data.scheduledEndDate) could be more explicit by checking for non-null values of data.duration, data.scheduledStartDate, and data.scheduledEndDate to avoid false positives when these fields are zero or empty strings.

github-actions · 2025-12-09T07:46:17Z

src/services/ChallengePhaseService.js

    });
+    if (shouldAttemptSuccessorRecalc) {
+      const scheduleChanged =
+        !datesAreSame(originalScheduledStartDate, updatedPhase.scheduledStartDate) ||


[💡 correctness]
The datesAreSame function is used to check if dates have changed. Ensure that this function correctly handles edge cases such as different time zones or daylight saving time changes.

github-actions · 2025-12-09T07:46:21Z

test/unit/ChallengePhaseService.test.js

    })

+    it('partially update challenge phase - recalculates successor schedules when review is extended', async function () {
+      this.timeout(50000)


[💡 performance]
The test case sets a timeout of 50000ms, which is quite high. Consider reducing it if possible to avoid unnecessarily long test execution times.

github-actions · 2025-12-09T07:46:21Z

test/unit/ChallengePhaseService.test.js

+      })
+
+      try {
+        const extendedDuration = reviewDuration * 2


[⚠️ correctness]
The extendedDuration is calculated as reviewDuration * 2. Ensure that this multiplication does not exceed any maximum duration constraints that might be defined elsewhere in the system.

github-actions · 2025-12-15T01:55:12Z

src/common/challenge-helper.js

-
-    const isConsistent = _.every(prizeSets, (prizeSet) =>
-      _.every(prizeSet.prizes, (prize) => prize.type === firstType)
+    const prizeTypes = _.uniq(


[💡 readability]
The use of _.flatMap and _.map to extract prize types is correct, but it could be simplified by using _.flatMap directly with a path argument: _.flatMap(prizeSets, 'prizes.type'). This would improve readability and maintainability.

github-actions · 2025-12-15T01:55:12Z

src/common/challenge-helper.js


-    if (!isConsistent) {
-      throw new errors.BadRequestError("All prizes must be of the same type");
+    if (prizeTypes.length === 0) {


[💡 style]
The check for prizeTypes.length === 0 is correct, but consider using _.isEmpty(prizeTypes) for consistency with the rest of the codebase, which uses lodash for similar checks.

github-actions · 2025-12-22T23:12:09Z

src/common/helper.js

+      _.get(project, "members", []),
+      (m) => _.toString(m.userId) === _.toString(currentUser.userId)
+    );
+    const role = _.toLower(_.get(member, "role", ""));


[⚠️ correctness]
The use of _.toLower on line 718 may lead to unexpected behavior if member.role is null or undefined. Consider providing a default value to avoid potential issues.

github-actions · 2025-12-22T23:12:09Z

src/common/helper.js

+    const role = _.toLower(_.get(member, "role", ""));
+    return PROJECT_WRITE_ACCESS_ROLES.has(role);
+  } catch (err) {
+    const status = _.get(err, "httpStatus") || _.get(err, "response.status");


[⚠️ maintainability]
The error handling on line 721 could be improved by rethrowing the error after logging it. This ensures that upstream functions are aware of the failure and can handle it appropriately.

github-actions · 2026-01-06T23:22:50Z

src/services/ChallengePhaseService.js

+  return new Date(dateA).getTime() === new Date(dateB).getTime();
+}
+
+function dateIsAfter(dateA, dateB) {


[⚠️ correctness]
The dateIsAfter function does not handle invalid date formats gracefully. Consider adding validation to ensure the input dates are valid before attempting to convert them to timestamps.

github-actions · 2026-01-06T23:22:50Z

src/services/ChallengePhaseService.js

+
+        let successorForQueue = successor;
+        if (_.isNil(successor.actualStartDate)) {
+          const alignToPredecessorStart = normalizePhaseName(successor.name) === "iterative review";


[💡 maintainability]
The logic for determining alignToPredecessorStart relies on the phase name being exactly 'iterative review'. Consider using a more flexible approach, such as checking against a set of phase names, to avoid potential issues with case sensitivity or minor name variations.

github-actions · 2026-01-06T23:22:50Z

src/services/ChallengePhaseService.js

    );
  }
+  const originalScheduledEndDate = challengePhase.scheduledEndDate;
+  const shouldAttemptSuccessorRecalc = Boolean(


[❗❗ correctness]
The removal of isReviewPhaseUpdate and its associated logic may affect the intended behavior of shouldAttemptSuccessorRecalc. Ensure that the new logic correctly captures all scenarios where successor recalculation is necessary.

github-actions · 2026-01-06T23:22:50Z

src/services/ChallengePhaseService.js

      },
    });
+    if (shouldAttemptSuccessorRecalc) {
+      const scheduleExtended = dateIsAfter(


[⚠️ correctness]
The scheduleExtended check only considers the scheduled end date. If the start date is also relevant for determining schedule changes, ensure it is included in the logic.

github-actions · 2026-01-06T23:23:00Z

test/unit/ChallengeService.test.js

    it('create challenge - invalid status', async () => {
      const challengeData = _.clone(testChallengeData)
-      challengeData.status = ['Active']
+      challengeData.status = ['ACTIVE']


[❗❗ correctness]
The change from ['Active'] to ['ACTIVE'] does not address the underlying issue of the status being an array instead of a string. The test is expected to fail with the error message "status" must be a string. Consider updating the test data to use a string for the status.

github-actions · 2026-01-06T23:23:00Z

test/unit/ChallengeService.test.js

        })
      } catch (e) {
-        should.equal(e.message.indexOf('Cannot change Completed challenge status to Active status') >= 0, true)
+        should.equal(e.message.indexOf('Cannot change COMPLETED challenge status to ACTIVE status') >= 0, true)


[⚠️ maintainability]
The change from Completed to COMPLETED in the error message check ensures consistency with the status values used in the application. Ensure that the application logic and error messages are consistently using uppercase status values if this is the intended convention.

PM-3327 De-duplicate challenge skills

fix(PM-2630): Able to close approval phase without an approver

…into account Topgear Submission

github-actions · 2026-01-07T22:15:14Z

src/common/prisma-helper.js

 const { dedupeChallengeTerms } = require("./helper");

-const SUBMISSION_PHASE_PRIORITY = ["Topcoder Submission", "Submission"];
+const SUBMISSION_PHASE_PRIORITY = ["Topgear Submission", "Topcoder Submission", "Submission"];


[⚠️ correctness]
The addition of "Topgear Submission" to the SUBMISSION_PHASE_PRIORITY array changes the priority order for finding the submission phase. Ensure that this change is intentional and that it aligns with the business logic, as it may affect which phase is selected as the submission phase.

kkartunov and others added 9 commits December 4, 2025 10:53

Merge pull request #58 from topcoder-platform/master

fc2f460

Master -> security

sec fixes

276d11e

deploy security to dev

44570c9

more sec in data folder

15b75ef

Recalculate successor phases when a review phase is extended (PS-473)

98f11bc

Merge pull request #59 from topcoder-platform/security

1d107ad

Security -> dev

switch to new lib location

f7cddbe

Merge pull request #60 from topcoder-platform/security

24b0795

switch to new lib location -> dev

drop lock file in data-migration

073a122

kkartunov requested a review from jmgasper December 9, 2025 07:46

github-actions bot reviewed Dec 9, 2025

View reviewed changes

kkartunov changed the title ~~Security fixes -> master~~ [PROD] - Security fixes -> master Dec 9, 2025

Better support for mixed prize sets (points and USD)

c0b45cd

github-actions bot reviewed Dec 15, 2025

View reviewed changes

Allow all project writers to view / edit private specification details

033a556

github-actions bot reviewed Dec 22, 2025

View reviewed changes

hentrymartin and others added 4 commits January 5, 2026 22:23

fix: able to open/close approval phase without an approver

6a26305

fix: able to open/close approval phase without an approver

1809f5d

fix: able to open/close approval phase without an approver

1ec0951

Challenge status consistency, and fix for PS-473

2bffec3

github-actions bot reviewed Jan 6, 2026

View reviewed changes

himaniraghav3 and others added 5 commits January 7, 2026 20:22

PM-3327 Deduplicate challenge skills

9417a83

deploy PM-3327

679f2d2

Merge pull request #63 from topcoder-platform/PM-3327

ef6e002

PM-3327 De-duplicate challenge skills

Merge pull request #62 from topcoder-platform/pm-2630

c2b8851

fix(PM-2630): Able to close approval phase without an approver

Fix issue with calculating submissionEndDate, where we aren't taking …

09428e6

…into account Topgear Submission

github-actions bot reviewed Jan 7, 2026

View reviewed changes

[PROD] - Security fixes -> master #61

Are you sure you want to change the base?

[PROD] - Security fixes -> master #61

Uh oh!

Conversation

kkartunov commented Dec 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot Dec 9, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Dec 9, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Dec 9, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Dec 9, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Dec 9, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Dec 9, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Dec 9, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Dec 9, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Dec 15, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Dec 15, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Dec 22, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Dec 22, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jan 6, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jan 6, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jan 6, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jan 6, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jan 6, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jan 6, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jan 7, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

kkartunov commented Dec 9, 2025 •

edited

Loading