Feature/week 06 by pratikr-3046 · Pull Request #90 · Rippling/interneers-lab

pratikr-3046 · 2026-04-18T10:38:36Z

Completed basic and advanced Week 06 tasks.

Note

Medium Risk
Adds new HTTP endpoints for CRUD and bulk ingestion and connects to MongoDB via mongoengine, which can impact data integrity and security (notably @csrf_exempt handlers) if deployed beyond local dev.

Overview
Adds a new week_04 Django project that connects to MongoDB and exposes JSON APIs to create/read/update/delete product categories and create/list products, including endpoints to assign/remove a product’s category and a products/bulk-upload/ CSV ingestion route.

Updates the existing Django hello endpoint to return a JSON greeting using a name query param, and adds a simple week_06 static page that fetches /api/products/ and renders product tiles. Frontend housekeeping includes switching App.tsx styling to App.scss and pinning Yarn via packageManager in package.json.

^{Reviewed by Cursor Bugbot for commit 6ab44c4. Configure here.}

cursor

Cursor Bugbot has reviewed your changes and found 4 potential issues.

^{Bugbot Autofix is ON, but it could not run because the branch was deleted or merged before autofix could start.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 6ab44c4. Configure here.}

cursor · 2026-04-18T10:47:44Z

+                <h2 class="title">${product.name}</h2>
+                <p class="description">Brand: ${product.brand}</p>
+                <div class="price">$${product.price}</div>
+            `;


XSS vulnerability via unsanitized innerHTML injection

High Severity

API response values (product.name, product.brand, product.price) are interpolated directly into innerHTML without any sanitization. Since the backend API accepts arbitrary strings for product names and brands (via both the POST endpoint and bulk_upload_products), an attacker can store a malicious payload like <img src=x onerror=alert(1)> as a product name, creating a stored XSS vulnerability that executes when any user loads the page. Using textContent or DOM creation methods instead of innerHTML would avoid this.

^{Reviewed by Cursor Bugbot for commit 6ab44c4. Configure here.}

cursor · 2026-04-18T10:47:44Z

+            category_id=row.get('category_id')
+        )
+
+    return JsonResponse({"status": "Bulk upload complete"})


Bulk upload lacks method check and error handling

Medium Severity

bulk_upload_products has two issues: it doesn't verify request.method == 'POST', so any HTTP method (GET, PUT, DELETE) triggers CSV processing; and it lacks error handling around the loop, so if create_product raises (e.g., invalid category_id), previously created products remain committed while the endpoint returns a 500 error. This causes silent partial writes with no indication of which rows succeeded.

^{Reviewed by Cursor Bugbot for commit 6ab44c4. Configure here.}

cursor · 2026-04-18T10:47:44Z

+                return JsonResponse({"status": "Success", "message": f"{product.name} removed from category"})
+            return JsonResponse({"error": "Product not found"}, status=404)
+        except Exception as e:
+             return JsonResponse({"error": str(e)})


View returns None for unsupported HTTP methods

Low Severity

api_for_a_product has no fallback return at the end. When an unsupported HTTP method (e.g., PATCH) is sent with a product_id, execution falls through all conditionals and the function implicitly returns None, causing Django to raise a ValueError and return a 500 error. The same issue applies to api_for_a_category. Both views lack a default return for unmatched methods.

Additional Locations (1)

week_04/products/views.py#L7-L55

^{Reviewed by Cursor Bugbot for commit 6ab44c4. Configure here.}

cursor · 2026-04-18T10:47:44Z

+                return JsonResponse({"status": "Success", "product": product.name, "category_id": str(product.category.id)})
+            return JsonResponse({"error": "Product not found"}, status=404)
+        except Exception as e:
+             return JsonResponse({"error": str(e)})


PUT errors return 200 instead of 404

Medium Severity

add_product_to_category raises ValueError for not-found products/categories, unlike the other service methods (e.g., remove_product_from_category) which return None. The view's PUT handler expects a None return to trigger the 404 response on line 125, but the ValueError is caught by the except block on line 126, which returns a 200 status (no status code specified). This means "product not found" and "category not found" errors on PUT always return HTTP 200 instead of a proper error status, making the 404 on line 125 unreachable dead code.

Additional Locations (1)

week_04/products/services.py#L50-L62

^{Reviewed by Cursor Bugbot for commit 6ab44c4. Configure here.}

anujsharma13rippling · 2026-04-19T05:15:45Z

+    # objects() is a special funciton written in the original document class from which ProductCategory is inherited
+    # we  can use it without intantiating the class
+    def get_category_by_id(self, category_id):
+        return ProductCategory.objects(id=category_id).first()


We can create a repo layer for model queries.
Like in repo file expose a function get_product_category_by_id(..)

anujsharma13rippling · 2026-04-19T05:15:53Z

+        return ProductCategory.objects(id=category_id).first()
+
+    def delete_category(self,category_id):
+        category = ProductCategory.objects(id=category_id).first()


same here also

anujsharma13rippling · 2026-04-19T05:17:02Z

+class ProductService():
+
+    def get_all_products(self):
+        return Product.objects()


same for all model related queries we can expose the methods for responsibility segregation

anujsharma13rippling · 2026-04-19T05:18:10Z

+    def add_product_to_category(self, product_id, category_id):
+        product = Product.objects(id=product_id).first()
+        if not product:
+            raise ValueError("product not found")


Always try to return Id also along with error message like ( same for all exceptions)
product not found with id = "123456789"

updated code to put id when method fails

anujsharma13rippling · 2026-04-19T05:19:43Z

+@csrf_exempt
+def api_for_a_category(request, category_id=None):
+
+    if request.method == 'GET':


As GET, POST, PUT, DELETE will be used at multiple views, we can define a constant for these rather than hardcoding

made a new file with all the http constants and all the error codes

anujsharma13rippling · 2026-04-19T05:20:49Z

+    if request.method == 'GET':
+        if category_id:
+            try:
+                c = category_service.get_category_by_id(category_id)


we can always try using meaningful variable names, like category

changed c and p to meaningful names

anujsharma13rippling · 2026-04-19T05:22:08Z

+            success = category_service.delete_category(category_id)
+            if success:
+                return JsonResponse({"status": "deleted"})
+            return JsonResponse({"error": "category not found"}, status=404)


as "category not found" error message is used at multiple places, can be defined in constants file.

Also we can define a map of Status code -> Error message.

anujsharma13rippling · 2026-04-19T05:23:44Z

+            try:
+                p = product_service.get_product_by_id(product_id)
+                if p:
+                    return JsonResponse({


Rather than manually creating key -> Values, we can define a DTO/Model to return as a response along with serializer, it will reduce the manual effort.

anujsharma13rippling · 2026-04-19T05:25:07Z

+                    return JsonResponse({"title": c.title, "description": c.description})
+                return JsonResponse({"error": "Category not found"}, status=404)
+            except Exception as e:
+                return JsonResponse({"error": str(e)})


By default the status code will be 200, if its a error we can send 4XX, 5XX based on error.

…to views

anujsharma13rippling · 2026-04-24T12:08:09Z

+from .models import ProductCategory, Product
+from .repositories import category_repo, product_repo
+
+class CategoryService:    


seperate file for each service.

anujsharma13rippling · 2026-04-24T12:09:32Z

+from .models import ProductCategory, Product
+
+class CategoryRepository:
+    def get_by_id(self, category_id):


same here we can create seperate files for both

anujsharma13rippling · 2026-04-24T12:13:31Z

@@ -0,0 +1,31 @@
+const container = document.getElementById('product-container');
+
+fetch('http://127.0.0.1:8000/api/products/')


url should not be hard coded in same file

pratikr-3046 added 3 commits March 9, 2026 15:55

Added hello_name endpoint

1e27c3a

Add Week 04 Django project to lab repository

25db9d3

Week 06:frontend API integration and CSS

6ab44c4

cursor Bot reviewed Apr 18, 2026

View reviewed changes

corrected code

c13431e

anujsharma13rippling reviewed Apr 19, 2026

View reviewed changes

pratikr-3046 added 4 commits April 24, 2026 13:23

added constants.py and serializers.py

1cfe1de

separated database queries into repository layer

bfa5b97

added repository layer into services and updated error messages

ef71b7b

refactor: apply serializers, constants, and strict HTTP status codes …

98fb7c0

…to views

anujsharma13rippling reviewed Apr 24, 2026

View reviewed changes

		@@ -0,0 +1,31 @@
		const container = document.getElementById('product-container');

		fetch('http://127.0.0.1:8000/api/products/')

Uh oh!

Conversation

pratikr-3046 commented Apr 18, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Apr 18, 2026

Choose a reason for hiding this comment

XSS vulnerability via unsanitized innerHTML injection

Uh oh!

cursor Bot Apr 18, 2026

Choose a reason for hiding this comment

Bulk upload lacks method check and error handling

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot Apr 18, 2026

Choose a reason for hiding this comment

View returns None for unsupported HTTP methods

Uh oh!

cursor Bot Apr 18, 2026

Choose a reason for hiding this comment

PUT errors return 200 instead of 404

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

anujsharma13rippling Apr 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

pratikr-3046 commented Apr 18, 2026 •

edited by cursor Bot

Loading

anujsharma13rippling Apr 19, 2026 •

edited

Loading