Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 10 additions & 2 deletions src/commands/suggest.ts
Original file line number Diff line number Diff line change
Expand Up @@ -147,7 +147,11 @@ async function acceptAndCommit(selected: Suggestion, config: Config, diff: strin
if (auto) {
try {
const result = commit(selected.message, selected.body);
console.log(pc.green(result.trim()));
if (result.hash) {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This styled output block is duplicated with the one in the manual-commit path below. Please extract it into a helper function like printCommitResult(result: CommitResult) to keep the code DRY.

console.log(` ${pc.green('✓')} ${pc.bold(pc.green(result.hash))} ${pc.dim(result.summary ?? '')}`);
} else {
console.log(pc.green(result.raw.trim()));
}
Comment on lines +150 to +154

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 MEDIUM RISK

Suggestion: The logic for displaying the commit success message is duplicated between the automated (lines 150-154) and manual (lines 215-219) flows. Consolidating this into a helper function like printCommitResult(result: CommitResult) would improve maintainability and help reduce the file's complexity, which has increased significantly in this PR.

} catch (err) {
const msg = err instanceof Error ? err.message : 'Unknown error';
outro(pc.red(`Commit failed: ${msg}`));
Expand Down Expand Up @@ -208,7 +212,11 @@ async function acceptAndCommit(selected: Suggestion, config: Config, diff: strin

try {
const result = commit(finalMessage, finalBody);
console.log(pc.green(result.trim()));
if (result.hash) {
console.log(` ${pc.green('✓')} ${pc.bold(pc.green(result.hash))} ${pc.dim(result.summary ?? '')}`);
} else {
console.log(pc.green(result.raw.trim()));
}

await appendEntry({
timestamp: new Date().toISOString(),
Expand Down
17 changes: 15 additions & 2 deletions src/git/diff.ts
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,13 @@
}


export function commit(message: string, body?: string): string {
export interface CommitResult {
raw: string;
hash?: string;
summary?: string;
}

export function commit(message: string, body?: string): CommitResult {
const fullMessage = body ? `${message}\n\n${body}` : message;
const tmpFile = join(tmpdir(), `commit-echo-msg-${process.pid}-${Date.now()}.txt`);
try {
Expand All @@ -51,7 +57,14 @@
const detail = [result.stderr, result.stdout].filter(Boolean).join('\n').trim();
throw new Error(detail || `git commit exited with code ${result.status}`);
}
return result.stdout;
const raw = result.stdout;
// Parse "[branch hash] summary" or "[branch (extra) hash] summary" pattern
const match = raw.match(/\[\S+(?:\s+\([^)]+\))?\s+([a-f0-9]+)\]\s+(.+)/);

Check warning on line 62 in src/git/diff.ts

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

src/git/diff.ts#L62

Unsafe Regular Expression

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 HIGH RISK

This regular expression is problematic for two reasons:

  1. Security: It is susceptible to Regular Expression Denial of Service (ReDoS) due to overlapping matching paths.
  2. Fragility: It fails to capture hashes in 'detached HEAD' states or when flags like 'root-commit' are present.

Consider using a more robust pattern:

const match = raw.match(/\[(?:.*\s+)?([a-f0-9]+)\]\s+(.+)/);

See Issue in Codacy

return {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The regex \S+ only matches a single word for the branch ref. In detached HEAD state, git commit outputs [detached HEAD abc1234]\S+ captures only detached, leaving HEAD unmatched by [a-f0-9]+. This causes the regex to fail, falling back to raw output.

Fix: Use [\w-]+(?:\s+[\w-]+)? or similar to capture multi-word refs like detached HEAD. Alternatively, use a more robust approach: match the hash after the last ] bracket, or use git rev-parse HEAD to get the hash directly instead of parsing the output string.

raw,
hash: match?.[1],
summary: match?.[2],
};
} finally {
try { unlinkSync(tmpFile); } catch {}
}
Expand Down