Spaces:
Sleeping
Sleeping
File size: 8,688 Bytes
2ac8bdd | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 | from app.models import PRType
PULL_REQUESTS = [
{
"pr_id": "PR-501",
"title": "Fix memory leak in background worker",
"description": "The worker was not releasing DB connections back to the pool, exhausting it.",
"author": "dev_alice",
"diff": "@@ -24,4 +24,5 @@ def process_job(job):\n conn = db.get_connection()\n try:\n conn.execute('UPDATE jobs SET status = \"done\" WHERE id = ?', (job.id,))\n+ finally:\n+ conn.close()",
"true_pr_type": PRType.BUG_FIX,
"true_bug_description": "None. The diff successfully addresses the connection leak by using a finally block.",
"true_review_comment": "Looks good! Releasing the connection in the finally block guarantees it returns to the pool even if the DB execute throws an exception.",
},
{
"pr_id": "PR-502",
"title": "Add user profile endpoint",
"description": "New feature to fetch the logged in user profile data.",
"author": "junior_bob",
"diff": "@@ -55,0 +56,3 @@ @app.route('/api/profile')\n+def get_profile():\n+ user_id = request.args.get('user_id')\n+ return db.query(f\"SELECT * FROM users WHERE id = {user_id}\")",
"true_pr_type": PRType.FEATURE,
"true_bug_description": "Critical SQL injection vulnerability in f-string query.",
"true_review_comment": "Block this PR. The database query uses an f-string directly incorporating user input `user_id`. This is a classic SQL injection vector. Please use parameterized queries instead: `db.query('SELECT * FROM users WHERE id = ?', (user_id,))`.",
},
{
"pr_id": "PR-503",
"title": "Refactor auth middleware",
"description": "Cleaning up the token verification function to be reusable.",
"author": "senior_charlie",
"diff": "@@ -10,8 +10,4 @@ def verify_token(req):\n- auth_header = req.headers.get('Authorization')\n- if not auth_header:\n- return False\n- token = auth_header.split(' ')[1]\n- return jwt.decode(token, SECRET, algorithms=['HS256']) is not None\n+ token = req.headers.get('Authorization', '').split('Bearer ')[-1]\n+ return bool(jwt.decode(token, SECRET, algorithms=['HS256'], options={'verify_exp': False}))",
"true_pr_type": PRType.SECURITY,
"true_bug_description": "Disabled JWT expiration verification (`verify_exp`: False).",
"true_review_comment": "Security risk: You have intentionally disabled the expiration verification of the JWT in the decoding options. This allows expired tokens to be accepted indefinitely. Please remove `options={'verify_exp': False}`.",
},
{
"pr_id": "PR-504",
"title": "Add retry logic to webhook sender",
"description": "Webhooks occasionally fail, adding exponential backoff.",
"author": "dev_dave",
"diff": "@@ -80,0 +81,7 @@ def send_webhook(payload):\n+ import time\n+ for i in range(3):\n+ res = requests.post('https://webhook.site', json=payload)\n+ if res.status_code == 200:\n+ return True\n+ time.sleep(2 ** i)\n+ return False",
"true_pr_type": PRType.FEATURE,
"true_bug_description": "Synchronous `time.sleep` in what might be an async or web context blocks the main thread.",
"true_review_comment": "Using `time.sleep` in the server thread will completely block that worker from handling other requests. We should move this logic to a background async task (like Celery) or use an async sleep `await asyncio.sleep()` depending on the framework.",
},
{
"pr_id": "PR-505",
"title": "Cleanup CSS classes for buttons",
"description": "Standardizing button classes across the admin dashboard.",
"author": "ui_diana",
"diff": "@@ -120,3 +120,3 @@ <form>\n- <button class='btn btn-primary submit-btn'>Save</button>\n+ <button class='btn-primary'>Save</button>\n </form>",
"true_pr_type": PRType.REFACTOR,
"true_bug_description": "Removed default `btn` class which usually provides structural CSS, and `submit-btn` which might be used by JS handlers.",
"true_review_comment": "You removed the base `.btn` class and the specialized `.submit-btn` class. Usually, UI frameworks rely on `.btn` for padding and borders, and our JavaScript might be using `.submit-btn` for event binding. Are you sure removing these won't break the layout or forms?",
},
{
"pr_id": "PR-506",
"title": "Fix typo in onboarding email",
"description": "Typo fix.",
"author": "dev_alice",
"diff": "@@ -5,3 +5,3 @@ def send_welcome():\n body = \"\"\"\n- Welcome to our plateform!\n+ Welcome to our platform!\n \"\"\"",
"true_pr_type": PRType.BUG_FIX,
"true_bug_description": "None",
"true_review_comment": "LGTM. Thanks for catching that!",
},
{
"pr_id": "PR-507",
"title": "Update React Hook usage",
"description": "Fixing a state update loop.",
"author": "ui_diana",
"diff": "@@ -22,3 +22,3 @@ function Counter() {\n- useEffect(() => {\n- setCount(count + 1);\n- });\n+ useEffect(() => {\n+ setCount(c => c + 1);\n+ }, []);",
"true_pr_type": PRType.BUG_FIX,
"true_bug_description": "None. Adding dependency array `[]` correctly stops the infinite re-render loop.",
"true_review_comment": "Great fix! Changing to the functional state updater and adding the empty dependency array perfectly resolves the infinite re-render loop.",
},
{
"pr_id": "PR-508",
"title": "Fix NoneType error on user deletion",
"description": "Sometimes user.metadata is None, crashing the script.",
"author": "dev_dave",
"diff": "@@ -40,1 +40,1 @@ def delete_user(user):\n- log(f\"Deleting {user.metadata['name']}\")\n+ log(f\"Deleting {user.metadata.get('name', 'Unknown')}\")\n db.delete(user)",
"true_pr_type": PRType.BUG_FIX,
"true_bug_description": "If `user.metadata` is `None`, calling `.get()` on it will throw an AttributeError.",
"true_review_comment": "This doesn't fully fix the bug. If `user.metadata` is entirely `None`, then `None.get()` will raise an `AttributeError`. You should do: `user.metadata.get('name') if user.metadata else 'Unknown'`.",
},
{
"pr_id": "PR-509",
"title": "Expose internal metric endpoint",
"description": "Adding a route for Datadog to ping our health and queue sizes.",
"author": "junior_bob",
"diff": "@@ -100,0 +100,3 @@ @app.route('/_internal/metrics')\n+def metrics():\n+ return jsonify({'queue_size': redis.llen('queue'), 'revenue': db.fetch_revenue()})",
"true_pr_type": PRType.FEATURE,
"true_bug_description": "Exposing highly sensitive financial metrics (`revenue`) on an unauthenticated endpoint.",
"true_review_comment": "We absolutely cannot expose the daily `revenue` on an unauthenticated endpoint, even if the path starts with `_internal`. It's accessible to the internet. Please wrap this endpoint in an authentication decorator or IP whitelist, and remove the revenue metric—Datadog only needs the queue sizes.",
},
{
"pr_id": "PR-510",
"title": "Hash passwords on user creation",
"description": "Ensure passwords aren't stored in plaintext.",
"author": "dev_alice",
"diff": "@@ -15,2 +15,3 @@ def create_user(username, password):\n- hashed = md5(password.encode()).hexdigest()\n+ import bcrypt\n+ hashed = bcrypt.hashpw(password.encode(), bcrypt.gensalt())\n db.insert('users', username=username, password=hashed)",
"true_pr_type": PRType.SECURITY,
"true_bug_description": "None. Upgrading from MD5 to bcrypt is exactly the right security patch.",
"true_review_comment": "Excellent change! Moving from MD5 to a strong adaptive hash like bcrypt is crucial. Approved.",
}
]
try:
from datasets import load_dataset
import random
_PR_DS = list(load_dataset("github-code-clean", split="train", streaming=True).take(50))
for row in _PR_DS:
PULL_REQUESTS.append({
"pr_id": f"PR-HF-{random.randint(1000,9999)}",
"title": "Update logic",
"description": "Extracted from HuggingFace github-code-clean dataset.",
"diff": row.get("text", "No diff available")[:1000],
"author": "hf_user",
"true_pr_type": PRType.REFACTOR,
"true_bug_description": "None",
"true_review_comment": "LGTM."
})
except Exception:
pass
|