Skip to content

test: add sample code for pr-agent review #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Prateekbala wants to merge 1 commit into from
Closed

test: add sample code for pr-agent review #1

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions test-review-me.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
// Missing await on async call
async function fetchUser(id: string) {
const result = fetch(`https://api.example.com/users/${id}`);
return result;
Comment on lines +2 to +4

@Prateekbala Prateekbala Oct 3, 2026

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Bug · medium — Missing await on async fetch call

The function fetchUser is declared async but calls fetch without awaiting, so it returns a Promise instead of the resolved response. Callers expecting a resolved value may get an unexpected Promise, leading to runtime errors.

Suggested change
async function fetchUser(id: string) {
const result = fetch(`https://api.example.com/users/${id}`);
return result;
async function fetchUser(id: string) {
const result = await fetch(`https://api.example.com/users/${id}`);
return result;
}

Confidence 90%

}

// Hardcoded secret
const API_KEY = "sk-prod-abc123supersecretkey";

@Prateekbala Prateekbala Oct 3, 2026

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 Security · high — Hardcoded secret API key

A secret API key is committed in source code, exposing credentials that could be abused to access the production service. This constitutes a credential leakage risk.

Suggested change
const API_KEY = "sk-prod-abc123supersecretkey";
const API_KEY = process.env.API_KEY; // Load from environment variable

Confidence 95%


// SQL injection risk
function getUser(db: any, userId: string) {
return db.query("SELECT * FROM users WHERE id = " + userId);
Comment on lines +11 to +12

@Prateekbala Prateekbala Oct 3, 2026

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 Security · high — SQL injection via string concatenation

The getUser function builds a SQL query by concatenating userId directly, allowing an attacker to inject arbitrary SQL. This can lead to data leakage or modification.

Suggested change
function getUser(db: any, userId: string) {
return db.query("SELECT * FROM users WHERE id = " + userId);
function getUser(db: any, userId: string) {
return db.query('SELECT * FROM users WHERE id = ?', [userId]); // Use parameterized query
}

Confidence 96%

}

// Empty catch
async function riskyOp() {
try {
await fetchUser("123");
} catch (e) {}
Comment on lines +15 to +19

@Prateekbala Prateekbala Oct 3, 2026

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Bug · low — Empty catch block swallows errors

The catch block catches exceptions from riskyOp but does nothing, silently ignoring failures. This makes debugging difficult and can hide runtime errors.

Suggested change
// Empty catch
async function riskyOp() {
try {
await fetchUser("123");
} catch (e) {}
} catch (e) {
console.error('riskyOp failed:', e);
throw e; // Re‑throw or handle appropriately
}

Confidence 85%

}
Loading