Skip to content

fix: update settings fallback html styling [IDE-1926]#737

Merged
andrewrobinsonhodges-snyk merged 3 commits intomainfrom
fix/IDE-1926_update-settings-fallback-html-styling
Apr 13, 2026
Merged

fix: update settings fallback html styling [IDE-1926]#737
andrewrobinsonhodges-snyk merged 3 commits intomainfrom
fix/IDE-1926_update-settings-fallback-html-styling

Conversation

@andrewrobinsonhodges-snyk
Copy link
Copy Markdown
Contributor

Description

Provide description of this PR and changes, if linked Jira ticket doesn't cover it in full.

Checklist

Screenshots / GIFs

Visuals that may help the reviewer. Please add screenshots for any UI change. GIFs are most welcome!

@snyk-io
Copy link
Copy Markdown

snyk-io bot commented Apr 10, 2026

Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
Open Source Security 0 0 0 0 0 issues
Licenses 0 0 0 0 0 issues
Code Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@snyk-pr-review-bot

This comment has been minimized.

acke added 2 commits April 13, 2026 10:47
Addresses SNYK-JS-LODASH-15869625 (arbitrary code injection) in lodash@4.17.23.

Made-with: Cursor
…te-settings-fallback-html-styling

Brings lodash ^4.18.1 (SNYK-JS-LODASH-15869625) from PR #738.
@snyk-pr-review-bot
Copy link
Copy Markdown

PR Reviewer Guide 🔍

🧪 No relevant tests
🔒 No security concerns identified
⚡ Recommended focus areas for review

Incorrect Fallback Logic 🟠 [major]

In collectData, the logic for cliBaseDownloadURL now falls back to the element's placeholder attribute if the input value is empty. This is problematic because placeholders are instructional UI elements. If a user clears the input field intending to use a system default or leave it unset, the code will instead capture and persist the literal placeholder string ('https://downloads.snyk.io') as a hardcoded configuration value. This prevents users from effectively clearing the setting.

cliBaseDownloadURL: get('cliBaseDownloadURL').value || get('cliBaseDownloadURL').placeholder,
📚 Repository Context Analyzed

This review considered 14 relevant code sections from 3 files (average relevance: 0.42)

@andrewrobinsonhodges-snyk andrewrobinsonhodges-snyk merged commit 2b2605b into main Apr 13, 2026
12 checks passed
@andrewrobinsonhodges-snyk andrewrobinsonhodges-snyk deleted the fix/IDE-1926_update-settings-fallback-html-styling branch April 13, 2026 09:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants