[BigSpaceships]

What

Updating dependencies broke a bunch of stuff, this fixes it

Why

Broken = bad

Test Plan

Lots of running locallly

Env Vars

I also made the webhook for slack pings for major projects be disabled by default, the value is correct in prod already so it won't break anything

Documentation

na

Checklist

• Tested all changes locally

[datadog-computersciencehouse]

         

⚠️ Warnings

🛠️ 1 Code quality issue detected

Medium: python-best-practices/function-variable-argument-name

Do not assign to function arguments View rule
conditional/blueprints/member_management.py:407

🛡️ 1 Code vulnerability detected

High: datadog/python-loginjection

Detected with AI
Potential log injection
conditional/blueprints/housing.py:133

ℹ️ Info

No other issues found (see more)

📚 No new vulnerable libraries detected
🧱 No new Infrastructure as Code (IaC) issues
🔑 No new secrets detected

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: e8dfe55 | Docs | Give us feedback!}

[datadog-computersciencehouse]

🟠 Medium: Code Quality Violation

variable name is the same as a function parameter (...read more)

A function parameter should only be read and not be modified. If your intent is to modify the value of the parameter, return the value in the function and handle the new value in the caller of the function.

_{Helpful? 👍/👎     
🚩 Report as false positive. Flags the rule for review to improve detection accuracy.}

[BigSpaceships]

me when i duplicate

import $ from 'jquery';

[datadog-computersciencehouse]

🔴 High: Code Vulnerability

Detected with AI

Potential log injection (...read more)

In Python, Log Injection (CWE-117) occurs when user-controlled input is embedded in a log message string without sanitization, enabling attackers to forge log entries via CRLF injection (\r\n) or inject ANSI escape sequences.

The vulnerability boundary is the log message string. Flag f-strings, concatenation, and the % operator — these embed user data in the message at the call site. Do NOT flag logger.info("msg: %s", value) (args form, comma-separated) — this is the stdlib lazy-evaluation pattern, equivalent to SLF4J {} in Java, and is safe. Structured patterns that keep user data in the extra dict or in a bound structlog context are also safe.

For example (vulnerable):

logging.info("Login attempt for user: " + username)       # concatenation
logging.warning(f"Search query: {request.args.get('q')}") # f-string
logger.info("User performed: %s" % action)                 # % operator at call site

Safe (structured or lazy args):

logger.info("login_attempt for user: %s", username)        # args form — NOT resolved at call site
logger.info("login_attempt", extra={"user": username})     # extra dict, fixed message
structlog.get_logger().bind(user=username).info("login_attempt")  # structlog bound context

How to remediate:

• Pass user data as extra dict keys (stdlib logging) or via structlog.bind() — keep the message string constant
• Use the args form logger.info("msg: %s", value) instead of f-strings or + concatenation
• If the message must include user data, strip CRLF first: input.replace('\r', '').replace('\n', '')

_{Helpful? 👍/👎   
🚩 Report as false positive. Flags the rule for review to improve detection accuracy.}

[NickJ-7010]

@BigSpaceships are you able to submit major projects on your machine? when I try it adds it to the database but returns 500 because the server errors with "requests.exceptions.InvalidURL: Failed to parse: Host 'INSERT URL HERE' contains invalid character ' '"

[BigSpaceships]

in the config files disable slack webhooks

[NickJ-7010]

@BigSpaceships I noticed a bug where you couldn't cancel the deletion modal of the attendance history page. I had to edit two files to fix this.

fetchUtil.js line 205:

}).then(response => {
      if (response.isDismissed)
        return;

      if (
        Object.hasOwn(response.value, 'success') &&
        response.value.success === true
      ) {

I return out early if the form was dismissed (canceled) so that it doesn't error when trying to get the results of a fetch request that never occurred.

cmReview.js line 144:

_deleteMeeting() {
    if (this.modal) {
      // Delete details
      FetchUtil.fetchWithWarning(
        this.endpoints.meetingDetails + this.cid,
        {

I deleted the disabling of the buttons since the form adds a dismiss area that covers the entire screen so you couldn't click it again anyways and it allows for you to click the delete button again if you accidentally dismissed the deletion modal.

[NickJ-7010]

oops, I left my comment earlier

[NickJ-7010]

Another thing I noticed is that you cannot delete co-ops, it sends a DELETE to /co_op/ but the backend expects int:uid, I'm not sure why but the frontend calls the username the uid so the proper route never gets triggered and it falls back to another route which returns a 405 (Method Not Allowed)

[BigSpaceships]

fixed

[NickJ-7010]

idk how I didn't catch this but newYear.js needs to import jQuery 💀

[NickJ-7010]

and the conditional POST endpoint /conditionals/review needs the cid casted to an int (it is returned to the backend as a string)

log.info(f'Updated conditional-{cid} to {status}')
conditional = Conditional.query.filter(Conditional.id == int(cid))
cond_obj = conditional.first()
uid = cond_obj.uid

[csh-sonarqube-community]

Quality Gate failed

• 13.85% Duplicated Lines (%) on New Code (is greater than 3.00%)

Project ID: ComputerScienceHouse_conditional_b4074151-bbfd-4fc3-b87d-10f1c1f625ab

View in SonarQube

[NickJ-7010]

everything that I could think of now works!