Repository navigation
fix: pr-bug-scan validated finding from #6335 - #8804
Merged
Merged
Conversation
Replaced unguarded crypto.randomUUID() with the established createBrowserUuid() fallback in both markup shape-id call sites.
…tests PR #8804 replaced two unguarded crypto.randomUUID() calls with createBrowserUuid(), matching the convention established in #5471, but shipped without extending that PR's regression-test pattern to the new call sites. Add hook-level tests for useMarkupPointerHandlers.onPointerDown and useMarkupEditor.commitPendingText under a simulated non-secure-context crypto global. Co-authored-by: Orca <help@stably.ai>
BrowserPane had its own inline crypto.randomUUID guard with a Date.now()+Math.random() fallback, duplicating the getRandomValues-based fallback already centralized in createBrowserUuid() and used at every other call site in the renderer. Co-authored-by: Orca <help@stably.ai>
AmethystLiang
force-pushed
the
bot/pr-bug-scan-6335-1784085783
branch
from
July 15, 2026 23:47
0f3505c to
c3860b6
Compare
6 tasks
4 of 5 tasks
enrick-dev
pushed a commit
to enrick-dev/orca
that referenced
this pull request
Oct 15, 2026
* fix: address pr-bug-scan validated finding from stablyai#6335 Replaced unguarded crypto.randomUUID() with the established createBrowserUuid() fallback in both markup shape-id call sites. * fix(review): cover markup crypto fallback call sites with regression tests PR stablyai#8804 replaced two unguarded crypto.randomUUID() calls with createBrowserUuid(), matching the convention established in stablyai#5471, but shipped without extending that PR's regression-test pattern to the new call sites. Add hook-level tests for useMarkupPointerHandlers.onPointerDown and useMarkupEditor.commitPendingText under a simulated non-secure-context crypto global. Co-authored-by: Orca <help@stably.ai> * fix(review): consolidate annotation bridge token onto createBrowserUuid BrowserPane had its own inline crypto.randomUUID guard with a Date.now()+Math.random() fallback, duplicating the getRandomValues-based fallback already centralized in createBrowserUuid() and used at every other call site in the renderer. Co-authored-by: Orca <help@stably.ai> --------- Co-authored-by: orca-bug-scan-bot <orca-bug-scan-bot@stably.ai> Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com> Co-authored-by: Orca <help@stably.ai>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated fix-PR from pr-bug-scan for parent #6335.
Fixer status:
FIXED_WITH_CODE_PROOFSummary: Replaced unguarded crypto.randomUUID() with the established createBrowserUuid() fallback in both markup shape-id call sites.
Blocked proof link:
src/renderer/src/components/browser-pane/markup/useMarkupPointerHandlers.ts:60 (and useMarkupEditor.ts:142) — the unguarded crypto.randomUUID() that threw in a non-secure LAN context now calls createBrowserUuid(), which falls back to getRandomValues/Math.random when randomUUID is undefinedTypecheck:
skippedProof (from validator)
code_analysisTypeError: crypto.randomUUID is not a functionin the React event handler; setInProgress is never reached, no shape is committed, and every draw/text gesture silently fails — the markup tool appears completely inert.const id = crypto.randomUUID()unguarded before setInProgressGenerated by
pr-bug-scan(proof-machine architecture). Human approval required before merge.