-
Notifications
You must be signed in to change notification settings - Fork 51
add PodGroup dashboard support #184
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
|
Welcome @vzhou-p! It looks like this is your first PR to volcano-sh/dashboard 🎉 |
Summary of ChangesHello @vzhou-p, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly enhances the dashboard's capabilities by integrating full support for Kubernetes PodGroups. It provides users with a dedicated section to monitor and manage their PodGroups, offering a clear overview through a sortable and filterable list, and the ability to inspect detailed YAML configurations. This feature improves visibility and control over PodGroup resources within the application. Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Code Review
This pull request adds dashboard support for PodGroups, including backend API endpoints and a full frontend implementation with list and detail views. The changes are well-structured and reuse existing components effectively. I've identified a potential Cross-Site Scripting (XSS) vulnerability in how YAML is displayed, which should be addressed. I've also left a couple of minor suggestions to remove debug logging and improve the UI feedback during data loading.
| <pre | ||
| dangerouslySetInnerHTML={{ | ||
| __html: selectedYaml, | ||
| }} | ||
| /> |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Using dangerouslySetInnerHTML with data that originates from an external source (the Kubernetes API in this case) can introduce a Cross-Site Scripting (XSS) vulnerability. The YAML content, especially keys and values, is being wrapped in HTML without proper escaping in frontend/src/components/podgroups/PodGroups.jsx. If a PodGroup name or another value in its YAML contains malicious HTML, it will be executed by the browser.
To fix this, you should either use a dedicated syntax highlighting library that handles sanitization safely (like react-syntax-highlighter), or ensure all content is properly HTML-escaped before being passed to dangerouslySetInnerHTML. The logic for formatting the YAML is in PodGroups.jsx inside the handleClick function and should be updated to escape HTML characters.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Fixed. I've updated the YAML formatting logic in PodGroups.jsx to use lodash.escape on both the keys and values before constructing the HTML string. This ensures that any user-supplied content is sanitized while still allowing us to wrap the keys in our custom tags for highlighting. The PodGroupDialog then safely renders this pre-sanitized string.
| console.log("Fetching podgroups with params:", { | ||
| namespace, | ||
| searchTerm, | ||
| statusFilter, | ||
| }); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
1f97fdc to
c24675b
Compare
- Add backend API endpoints for PodGroups (list, details, YAML) - Add frontend route and navigation for PodGroups - Create PodGroup list view with filtering and sorting - Add PodGroup details dialog - Update tests Signed-off-by: Victor Zhou <binghua.zhou.ca@gmail.com>
c24675b to
cdec418
Compare
|
@vzhou-p There are some CI failures, could you take a look? |
mtian29
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks @vzhou-p
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: mtian29 The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
@vzhou-p Seems that still have some lint erorrs, please take a look |
add PodGroup dashboard support