fix(query-devtools): sanitize invalid browser locales#10321
fix(query-devtools): sanitize invalid browser locales#10321jakvbs wants to merge 3 commits intoTanStack:mainfrom
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
✅ Files skipped from review due to trivial changes (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughAdded locale-safety utilities and integrated a reactive, sanitized locale signal via an I18nProvider into the devtools UI; replaced direct toLocale* calls with formatDateTime/formatTime and added tests and a changeset. Changes
Sequence DiagramsequenceDiagram
participant Browser
participant DevtoolsComponent
participant I18nProvider
participant Devtools
participant LocaleSignal as locale()
participant Formatter as formatDateTime/formatTime
Browser->>DevtoolsComponent: mount
DevtoolsComponent->>DevtoolsComponent: createSafeLocale() -> locale signal
DevtoolsComponent->>I18nProvider: provide locale(locale())
I18nProvider->>Devtools: render children with locale context
Devtools->>LocaleSignal: useLocale()
LocaleSignal-->>Devtools: current sanitized locale
Devtools->>Formatter: formatDateTime(timestamp, locale)
Formatter-->>Devtools: formatted string
Browser->>DevtoolsComponent: languagechange event
DevtoolsComponent->>LocaleSignal: update locale signal
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~22 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
packages/query-devtools/src/Devtools.tsx (2)
2053-2058:⚠️ Potential issue | 🟡 MinorInconsistent:
QueryDetailsstill uses unsafetoLocaleTimeString().This code path can still throw a
RangeErrorif the browser reports an invalid locale. For consistency with the mutation formatting changes, consider using the safe locale helper here as well.Suggested fix
Add
useLocale()toQueryDetailsand update the formatting:const QueryDetails = () => { + const locale = useLocale() const theme = useTheme() // ... <span> - {new Date(activeQueryState()!.dataUpdatedAt).toLocaleTimeString()} + {formatDateTime(activeQueryState()!.dataUpdatedAt, locale.locale())} </span>Note: You may want a
formatTimehelper if you prefer time-only output, or adjustformatDateTimeto accept a format option.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@packages/query-devtools/src/Devtools.tsx` around lines 2053 - 2058, QueryDetails currently calls new Date(activeQueryState()!.dataUpdatedAt).toLocaleTimeString() which can throw a RangeError for invalid locales; update QueryDetails to use the safe locale helper by importing and calling useLocale() (or retrieving the locale via existing hook) and then format the timestamp with the existing formatDateTime or a new formatTime helper instead of toLocaleTimeString; replace the direct Date.toLocaleTimeString call with formatDateTime(activeQueryState()!.dataUpdatedAt, { locale }) or formatTime(activeQueryState()!.dataUpdatedAt, locale), and if needed adjust formatDateTime signature to accept a time-only option.
2495-2502:⚠️ Potential issue | 🟡 MinorInconsistent:
MutationDetailsstill uses unsafetoLocaleTimeString().Same issue as in
QueryDetails. This "Submitted At" display can throw if the browser has an invalid locale.Suggested fix
const MutationDetails = () => { + const locale = useLocale() const theme = useTheme() // ... <span> - {new Date( - activeMutation()!.state.submittedAt, - ).toLocaleTimeString()} + {formatDateTime(activeMutation()!.state.submittedAt, locale.locale())} </span>🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@packages/query-devtools/src/Devtools.tsx` around lines 2495 - 2502, The "Submitted At" render in Devtools.tsx uses new Date(activeMutation()!.state.submittedAt).toLocaleTimeString(), which can throw for invalid locales; update the MutationDetails rendering to format the date safely by wrapping the toLocaleTimeString call in a try/catch (or using Intl.DateTimeFormat with a safe fallback) and falling back to a stable representation like toISOString() or a hardcoded locale (e.g., 'en-US') if formatting fails; locate the code around activeMutation(), state.submittedAt and replace the unsafe toLocaleTimeString usage with the safe formatter and fallback logic so the component never throws when rendering timestamps.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In `@packages/query-devtools/src/Devtools.tsx`:
- Around line 2053-2058: QueryDetails currently calls new
Date(activeQueryState()!.dataUpdatedAt).toLocaleTimeString() which can throw a
RangeError for invalid locales; update QueryDetails to use the safe locale
helper by importing and calling useLocale() (or retrieving the locale via
existing hook) and then format the timestamp with the existing formatDateTime or
a new formatTime helper instead of toLocaleTimeString; replace the direct
Date.toLocaleTimeString call with
formatDateTime(activeQueryState()!.dataUpdatedAt, { locale }) or
formatTime(activeQueryState()!.dataUpdatedAt, locale), and if needed adjust
formatDateTime signature to accept a time-only option.
- Around line 2495-2502: The "Submitted At" render in Devtools.tsx uses new
Date(activeMutation()!.state.submittedAt).toLocaleTimeString(), which can throw
for invalid locales; update the MutationDetails rendering to format the date
safely by wrapping the toLocaleTimeString call in a try/catch (or using
Intl.DateTimeFormat with a safe fallback) and falling back to a stable
representation like toISOString() or a hardcoded locale (e.g., 'en-US') if
formatting fails; locate the code around activeMutation(), state.submittedAt and
replace the unsafe toLocaleTimeString usage with the safe formatter and fallback
logic so the component never throws when rendering timestamps.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 9d0f7d4f-a138-42ad-8a09-2a83e6a41225
📒 Files selected for processing (5)
packages/query-devtools/src/Devtools.tsxpackages/query-devtools/src/DevtoolsComponent.tsxpackages/query-devtools/src/DevtoolsPanelComponent.tsxpackages/query-devtools/src/__tests__/locale.test.tspackages/query-devtools/src/utils.tsx
|
Nice fix. One observation on The |
What
I18nProviderwith the sanitized locale and route mutation date formatting through the sanitized locale helpersnavigator.languagevalues like"undefined"@tanstack/query-devtoolsWhy
@tanstack/query-devtoolscan currently throw at runtime when the browser reports an invalid locale string, for examplenavigator.language === "undefined"How tested
npx nx run @tanstack/query-devtools:test:eslintnpx nx run @tanstack/query-devtools:test:typesnpx nx run @tanstack/query-devtools:test:libnpx nx run @tanstack/query-devtools:buildnpx nx run @tanstack/query-devtools:test:build145.0.7632.6and Firefox146.0.1; verified the unfixed published packages throw and the patched local packages no longer doFixes #10286.
Summary by CodeRabbit
New Features
Bug Fixes
Tests