Skip to content

Add error boundary component and enhance API client configuration#12

Merged
moutonjeremy merged 1 commit intomainfrom
security-fix
Apr 19, 2026
Merged

Add error boundary component and enhance API client configuration#12
moutonjeremy merged 1 commit intomainfrom
security-fix

Conversation

@moutonjeremy
Copy link
Copy Markdown
Member

This pull request introduces several improvements and fixes across the codebase, focusing primarily on security, configuration flexibility, error handling, and code quality. The most significant change is the complete removal of JavaScript eval/Function usage in formula evaluation, replaced with a fully safe, recursive-descent parser. Additionally, the app now features a global error boundary for better runtime error handling, improved environment variable configuration for API and WebSocket URLs, and minor fixes to hooks.

Security and Safety Improvements

  • src/lib/database/formula.ts: Replaced all uses of eval/Function in formula evaluation with a custom, safe recursive-descent parser for math and conditions. This eliminates code injection risks and ensures all formulas are securely parsed and evaluated. [1] [2] [3]

Error Handling

  • src/components/error-boundary.tsx, src/App.tsx: Added a global ErrorBoundary component that catches and displays runtime errors in the UI, preventing the app from crashing on uncaught errors. The main App component is now wrapped in this boundary. [1] [2] [3] [4]

Configuration and Environment Variables

  • README.md, src/api/client.ts, src/hooks/use-collaboration.ts: Improved documentation and code to support flexible configuration of API and collaboration WebSocket URLs via environment variables (VITE_API_URL, VITE_COLLAB_WS_URL). This makes deployment to different environments much easier and more robust. [1] [2] [3] [4]

Hooks and Code Quality

  • src/hooks/ui/useEditableField.ts: Fixed a bug where timeouts could leak by using a ref and cleaning up on unmount, ensuring that delayed callbacks in editable fields do not cause memory leaks or unexpected behavior. [1] [2] [3]

Documentation

  • README.md: Major update to the documentation, clarifying project setup, configuration, environment variables, and project structure for easier onboarding and environment management.

@moutonjeremy moutonjeremy merged commit df635fc into main Apr 19, 2026
1 check passed
@moutonjeremy moutonjeremy deleted the security-fix branch April 19, 2026 23:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant