fix: add strict URL validation with consistent error message#22843
fix: add strict URL validation with consistent error message#22843anikdhabal merged 6 commits intocalcom:mainfrom
Conversation
WalkthroughThe code change enhances the URL validation logic in the form builder schema's Estimated code review effort🎯 2 (Simple) | ⏱️ ~7 minutes Assessment against linked issues
Assessment against linked issues: Out-of-scope changesNo out-of-scope changes were found. 📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (8)
✨ Finishing Touches
🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
|
@sahitya-chandra is attempting to deploy a commit to the cal Team on Vercel. A member of the Team first needs to authorize it. |
github-actions
bot
added
Low priority
Graphite Automations"Add consumer team as reviewer" took an action on this PR • (07/31/25)1 reviewer was added to this PR based on Keith Williams's automation. "Add community label" took an action on this PR • (07/31/25)1 label was added to this PR based on Keith Williams's automation. "Add ready-for-e2e label" took an action on this PR • (08/08/25)1 label was added to this PR based on Keith Williams's automation. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
packages/features/form-builder/schema.ts (1)
402-413: Simplified validation aligns with PR objectives, but consider required field handling.The new validation logic successfully implements strict URL validation with consistent error messaging as requested. However, there are a few considerations:
Double trimming: The response is trimmed in both
preprocess(line 400) andsuperRefine(line 403). The trimming insuperRefineis redundant since preprocessing already handles this.Required field validation: The current logic doesn't explicitly handle the case where a URL field is required but empty. An empty string will fail URL validation and show "Invalid URL" instead of a more appropriate "This field is required" message.
Consider this improvement to handle required fields more appropriately:
superRefine: ({ response, ctx, m, field, isPartialSchema }) => { - const value = response?.trim() ?? ""; + const value = response ?? ""; + // Handle required field validation first + if (field.required && !isPartialSchema && !value) { + ctx.addIssue({ + code: z.ZodIssueCode.custom, + message: m("error_required_field"), + }); + return; + } + + // Skip URL validation for empty optional fields + if (!value) { + return; + } const urlSchema = z.string().url(); if (!urlSchema.safeParse(value).success) { ctx.addIssue({ code: z.ZodIssueCode.custom, message: m("Invalid URL"), }); } },
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
packages/features/form-builder/schema.ts(1 hunks)
🧰 Additional context used
📓 Path-based instructions (2)
**/*.ts
📄 CodeRabbit Inference Engine (.cursor/rules/review.mdc)
**/*.ts: For Prisma queries, only select data you need; never useinclude, always useselect
Ensure thecredential.keyfield is never returned from tRPC endpoints or APIs
Files:
packages/features/form-builder/schema.ts
**/*.{ts,tsx}
📄 CodeRabbit Inference Engine (.cursor/rules/review.mdc)
Flag excessive Day.js use in performance-critical code; prefer native Date or Day.js
.utc()in hot paths like loops
Files:
packages/features/form-builder/schema.ts
🧠 Learnings (2)
📚 Learning: in signup-view.tsx, when checking if redirecturl contains certain strings, using explicit && checks ...
Learnt from: Anshumancanrock
PR: calcom/cal.com#22570
File: apps/web/modules/signup-view.tsx:253-253
Timestamp: 2025-07-21T21:33:23.371Z
Learning: In signup-view.tsx, when checking if redirectUrl contains certain strings, using explicit && checks (redirectUrl && redirectUrl.includes()) is preferred over optional chaining (redirectUrl?.includes()) to ensure the result is always a boolean rather than potentially undefined. This approach provides cleaner boolean contracts for downstream conditional logic.
Applied to files:
packages/features/form-builder/schema.ts
📚 Learning: in the insightsroutingservice (packages/lib/server/service/insightsrouting.ts), multi-select filter ...
Learnt from: eunjae-lee
PR: calcom/cal.com#22106
File: packages/lib/server/service/insightsRouting.ts:367-368
Timestamp: 2025-07-15T13:02:17.403Z
Learning: In the InsightsRoutingService (packages/lib/server/service/insightsRouting.ts), multi-select filter data is already validated by zod before reaching the buildFormFieldSqlCondition method, so null/undefined values are not present in filterValue.data arrays and don't need to be filtered out.
Applied to files:
packages/features/form-builder/schema.ts
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: required
🔇 Additional comments (1)
packages/features/form-builder/schema.ts (1)
399-401: LGTM: Preprocessing with trimming is appropriate.The preprocessing step correctly trims whitespace from URL inputs, which is a good practice for user input sanitization.
sahitya-chandra
changed the title
|
@volnei @anikdhabal sir can you review this |
E2E results are ready! |
…22843) * added strict url validation with consistent Invalid URL error message * chore * Update schema.ts --------- Co-authored-by: Anik Dhabal Babu <[email protected]>
2 participants
What does this PR do?
Added validation for url to have at least one dot in url
Visual Demo (For contributors especially)
Previously, when user passed random input like "sadasad" it passed the url checks...
Screencast.from.2025-07-31.21-39-38.webm
A visual demonstration is strongly recommended, for both the original and new change (video / image - any one).
Video Demo (if applicable):
Image Demo (if applicable):
Mandatory Tasks (DO NOT REMOVE)
How should this be tested?
Checklist