blog: support tags by gapry · Pull Request #47 · gapry/gapry.github.io

gapry · 2026-03-28T17:23:39Z

No description provided.

amazon-q-developer

Code Review Summary

This PR adds tags functionality to the blog, including tag extraction from markdown frontmatter, tag cloud page, and tag filtering. The implementation is mostly well-structured, but there are critical security and logic issues that must be fixed before merging.

Critical Issues (Must Fix):

Security vulnerability: Path traversal risk in tag directory creation - unsanitized tag names from markdown are used in file paths
Logic error: Missing bounds check when accessing parts[1] in tag routing will cause runtime crashes

Required Changes:

Sanitize tag names before using them in file paths
Add proper validation for tag route parameters
Remove debug console.log statements
Remove unused variables

Please address these issues before merging.

You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.

amazon-q-developer · 2026-03-28T17:24:33Z

+    console.log("Current Path Parts:", window.location.pathname.split('/').filter(Boolean));
+    console.log("All Posts Data:", allPosts)


Remove debug console.log statements before merging to production. These expose internal application state and routing information in browser console.

Suggested change

console.log("Current Path Parts:", window.location.pathname.split('/').filter(Boolean));

console.log("All Posts Data:", allPosts)

const params = new URLSearchParams(window.location.search);

amazon-q-developer · 2026-03-28T17:24:33Z

+  allTags.forEach(tag => {
+    const tagDir = path.join(distDir, 'tag', tag);

+    if (!fs.existsSync(tagDir)) {
+      fs.mkdirSync(tagDir, { 
+        recursive: true 
+      });
+    }
+
+    fs.copyFileSync(
+      path.join(distDir, 'index.html'), 
+      path.join(tagDir, 'index.html')
+    );
+  });


🛑 Security Vulnerability: Tag names from markdown files are used directly in file path construction without sanitization, creating a path traversal vulnerability. An attacker could craft markdown with malicious tags like ../../etc/passwd to write files outside the intended directory.¹

Suggested change

allTags.forEach(tag => {

const tagDir = path.join(distDir, 'tag', tag);

if (!fs.existsSync(tagDir)) {

fs.mkdirSync(tagDir, {

recursive: true

});

}

fs.copyFileSync(

path.join(distDir, 'index.html'),

path.join(tagDir, 'index.html')

);

});

allTags.forEach(tag => {

const sanitizedTag = tag.replace(/[^a-zA-Z0-9-_]/g, '-');

const tagDir = path.join(distDir, 'tag', sanitizedTag);

if (!fs.existsSync(tagDir)) {

fs.mkdirSync(tagDir, {

recursive: true

});

}

fs.copyFileSync(

path.join(distDir, 'index.html'),

path.join(tagDir, 'index.html')

);

});

Footnotes

CWE-22: Path Traversal - https://cwe.mitre.org/data/definitions/22.html ↩

amazon-q-developer · 2026-03-28T17:24:33Z

+  const isTagPage  = window.location.pathname.includes('/tag/');
+  const currentTag = isTagPage ? decodeURIComponent(window.location.pathname.split('/').filter(Boolean).pop()) : null;


Remove unused variables isTagPage and currentTag. These are declared but never referenced in the component.

Suggested change

const isTagPage = window.location.pathname.includes('/tag/');

const currentTag = isTagPage ? decodeURIComponent(window.location.pathname.split('/').filter(Boolean).pop()) : null;

useEffect(() => {

amazon-q-developer · 2026-03-28T17:24:33Z

+    if (parts[0] === 'tag' && parts[1]) {
+      const tagName  = decodeURIComponent(parts[1]);
+      const filtered = allPosts.filter(p => p.tags && p.tags.includes(tagName));
+
+      document.title = `Tag: ${tagName} | ${siteConfig.siteName}`;      
+      setPosts(filtered); 
+      setStatus('home'); 
+      return;
+    }


🛑 Logic Error: Missing bounds check before accessing parts[1] will cause runtime error when URL is /tag/ without a tag name. This crashes the routing logic.

Suggested change

if (parts[0] === 'tag' && parts[1]) {

const tagName = decodeURIComponent(parts[1]);

const filtered = allPosts.filter(p => p.tags && p.tags.includes(tagName));

document.title = `Tag: ${tagName} | ${siteConfig.siteName}`;

setPosts(filtered);

setStatus('home');

return;

}

if (parts.length === 2 && parts[0] === 'tag') {

const tagName = decodeURIComponent(parts[1]);

const filtered = allPosts.filter(p => p.tags && p.tags.includes(tagName));

document.title = `Tag: ${tagName} | ${siteConfig.siteName}`;

setPosts(filtered);

setStatus('home');

return;

}

gemini-code-assist

Code Review

This pull request implements a tagging system for the blog, adding tag extraction to the build process and creating a new Tags page and tag-filtered views. The UI now displays tag pills in posts and links in the header and home feed. Feedback focuses on code cleanliness, specifically removing duplicate CSS rules, debug logs, and unused variables or props, as well as improving CSS specificity by avoiding the use of !important.

gemini-code-assist · 2026-03-28T17:25:00Z

+.site-header {
+  width: 100%;
+  border-bottom: 1px solid #333;
+  padding: 1.5rem 0 0.5rem 0; 
+  margin-bottom: 0;
 }


There are duplicate styles for the .site-header class here and in src/components/Header/Header.css. This can lead to unpredictable styling depending on CSS import order. Since .site-header is part of the Header component, its styles should be defined only in src/components/Header/Header.css. Please remove these rules from this file to avoid conflicts and keep the styling organized.

gemini-code-assist · 2026-03-28T17:25:00Z

+    console.log("Current Path Parts:", window.location.pathname.split('/').filter(Boolean));
+    console.log("All Posts Data:", allPosts)
+


These console.log statements appear to be for debugging purposes. They should be removed before merging to keep the console clean in production.

gemini-code-assist · 2026-03-28T17:25:00Z

      <Analytics />
      <div className="app-shell">
-        <Header />
+        <Header allPosts={posts} />


The Header component is being passed the allPosts prop, but it doesn't seem to be using it. If this prop is not needed, it should be removed to avoid passing unnecessary data and to keep the component's API clean.

Suggested change

<Header allPosts={posts} />

<Header />

gemini-code-assist · 2026-03-28T17:25:00Z

+.markdown-body > h1, 
+.markdown-body > h2, 
+.markdown-body > p {
+  margin-top: 0.8rem !important; 


Using !important should be avoided as it can make CSS difficult to maintain and debug by breaking the natural cascade. It's better to increase selector specificity or reorder rules if you need to override styles.

Suggested change

margin-top: 0.8rem !important;

margin-top: 0.8rem;

gemini-code-assist · 2026-03-28T17:25:00Z

+  const isTagPage  = window.location.pathname.includes('/tag/');
+  const currentTag = isTagPage ? decodeURIComponent(window.location.pathname.split('/').filter(Boolean).pop()) : null;


The isTagPage and currentTag variables are declared but never used within the component. This appears to be dead code and should be removed to improve code clarity.

gapry · 2026-03-28T20:34:14Z

/q review

gapry · 2026-03-28T20:34:26Z

/gemini review

amazon-q-developer

Review Summary

This PR adds tag support to the blog, implementing tag extraction from markdown files, tag cloud page, and tag filtering. However, there are critical security vulnerabilities that must be fixed before merge.

Critical Issues (Must Fix)

Security Vulnerabilities:

Path Traversal in post.config.js - Tag names from markdown files are used directly in filesystem paths without sanitization, enabling directory traversal attacks
URL Injection in Tags.jsx and Home.jsx - Tag names embedded in URLs without encoding can create malformed URLs or enable injection attacks

Crash Risk:
3. Array Bounds Check in App.jsx - Missing validation on parts[0] when array may be empty causes runtime error

Required Actions

All four comments contain commit-ready fixes that address these blocking issues. Please apply these security fixes before merging.

You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.

amazon-q-developer · 2026-03-28T20:35:16Z

+      return;
+    }
+
+    if (parts[0] === 'tag' && parts[1]) {


🛑 Crash Risk: Missing bounds check on parts[0] when parts array is empty. Accessing parts[0] without verifying array length causes runtime error when URL path is malformed or empty after filtering.

Suggested change

if (parts[0] === 'tag' && parts[1]) {

if (parts.length >= 2 && parts[0] === 'tag' && parts[1]) {

amazon-q-developer · 2026-03-28T20:35:16Z

+  const allTags = [...new Set(allPosts.flatMap(p => p.tags))];
+
+  allTags.forEach(tag => {
+    const tagDir = path.join(distDir, 'tag', tag);


🛑 Security Vulnerability: Tag names are used directly in filesystem paths without sanitization, enabling path traversal attacks. A malicious markdown file with tags: ../../malicious could write files outside the intended directory structure, potentially overwriting critical system files or injecting malicious content.

Suggested change

const tagDir = path.join(distDir, 'tag', tag);

const sanitizedTag = tag.replace(/[^a-zA-Z0-9_-]/g, '-');

const tagDir = path.join(distDir, 'tag', sanitizedTag);

amazon-q-developer · 2026-03-28T20:35:16Z

+    <div className="tags-page">
+      <div className="tags-cloud-wrapper">
+        {tagStats.map(([tag, count]) => (
+          <a key={tag} href={`/tag/${tag}`} className="tag-cloud-item">


🛑 Security Vulnerability: Tag names are embedded in URLs without encoding. Tags containing special characters (spaces, slashes, etc.) will create malformed URLs or enable injection attacks. Use encodeURIComponent(tag) to properly escape special characters in the URL.

Suggested change

<a key={tag} href={`/tag/${tag}`} className="tag-cloud-item">

<a key={tag} href={`/tag/${encodeURIComponent(tag)}`} className="tag-cloud-item">

amazon-q-developer · 2026-03-28T20:35:16Z

+            {post.tags && post.tags.length > 0 && (
+              <div className="post-tags">
+                {post.tags.map(tag => (
+                  <a key={tag} href={`/tag/${tag}`} className="tag-link">


🛑 Security Vulnerability: Tag names are embedded in URLs without encoding. Tags containing special characters (spaces, slashes, etc.) will create malformed URLs or enable injection attacks. Use encodeURIComponent(tag) to properly escape special characters in the URL.

Suggested change

<a key={tag} href={`/tag/${tag}`} className="tag-link">

<a key={tag} href={`/tag/${encodeURIComponent(tag)}`} className="tag-link">

gemini-code-assist

Code Review

This pull request introduces a tagging system for blog posts, including frontmatter parsing in the build script, new routing logic in the React application, and a dedicated tags cloud page. It also includes several CSS adjustments to the header and markdown rendering. Feedback focuses on removing redundant file generation in the build script, avoiding the use of !important in CSS to maintain better style specificity, and reducing code duplication by passing tags as props instead of re-parsing frontmatter in the frontend.

gemini-code-assist · 2026-03-28T20:36:19Z

+    path.join(tagsPageDir, 'index.html') 
  );
+
+  const PagesComponents = ['404.html', 'about.html', 'tags.html']; 


You are creating dist/tags/index.html in lines 100-107, and here you are also creating dist/tags.html. This is redundant. The routing logic will handle /tags with tags/index.html, so you can remove 'tags.html' from this array.

Suggested change

const PagesComponents = ['404.html', 'about.html', 'tags.html'];

const PagesComponents = ['404.html', 'about.html'];

gemini-code-assist · 2026-03-28T20:36:19Z

+}
+
+.markdown-body h2 {
+  margin-top: 0px !important;


Using !important is generally discouraged as it can lead to CSS specificity issues and make maintenance harder. It seems this rule is intended to override another style. A better approach would be to increase the selector's specificity or adjust the conflicting style directly.

gemini-code-assist · 2026-03-28T20:36:19Z

+  const frontmatterMatch = content.match(/^---\s*\n([\s\S]*?)\n---\s*\n/);
+
+  let tags = [];
+  let cleanContent = content;
+
+  if (frontmatterMatch) {
+    const frontmatter = frontmatterMatch[1];
+    const tagsLine = frontmatter.match(/^tags:\s*(.*)$/m);
+    if (tagsLine) {
+      tags = tagsLine[1].split(',').map(t => t.trim()).filter(Boolean);
+    }
+    cleanContent = content.replace(/^---\s*\n[\s\S]*?\n---\s*\n/, '').trim();
+  }


This frontmatter parsing logic is also present in post.config.js. To avoid this duplication, you could enhance the App component to pass the tags array (which it can get from the post metadata in posts.json) as a prop to MarkdownRenderer. This component would then only need to strip the frontmatter from the content, not parse it again. This would make the component's responsibility clearer and reduce code duplication.

gemini-code-assist · 2026-03-28T20:36:19Z

+.markdown-body > h2:first-child,
+.markdown-body > h3:first-child,
+.markdown-body > p:first-child {
+  margin-top: 0.5rem !important;


Using !important should be avoided as it breaks the natural cascade of stylesheets and can lead to maintenance headaches. Please try to achieve the desired styling by using a more specific selector or refactoring the CSS to avoid the need for !important.

blog: support tags

358738d

amazon-q-developer Bot reviewed Mar 28, 2026

View reviewed changes

gemini-code-assist Bot reviewed Mar 28, 2026

View reviewed changes

blog: support tags: fix

4f960fa

amazon-q-developer Bot reviewed Mar 28, 2026

View reviewed changes

gemini-code-assist Bot reviewed Mar 28, 2026

View reviewed changes

gapry merged commit 388ba7c into main Mar 28, 2026
2 checks passed

gapry deleted the tags branch March 28, 2026 20:45

		console.log("Current Path Parts:", window.location.pathname.split('/').filter(Boolean));
		console.log("All Posts Data:", allPosts)

	console.log("Current Path Parts:", window.location.pathname.split('/').filter(Boolean));
	console.log("All Posts Data:", allPosts)
	const params = new URLSearchParams(window.location.search);

		const isTagPage = window.location.pathname.includes('/tag/');
		const currentTag = isTagPage ? decodeURIComponent(window.location.pathname.split('/').filter(Boolean).pop()) : null;

	const isTagPage = window.location.pathname.includes('/tag/');
	const currentTag = isTagPage ? decodeURIComponent(window.location.pathname.split('/').filter(Boolean).pop()) : null;
	useEffect(() => {

	if (parts[0] === 'tag' && parts[1]) {
	if (parts.length >= 2 && parts[0] === 'tag' && parts[1]) {

	const tagDir = path.join(distDir, 'tag', tag);
	const sanitizedTag = tag.replace(/[^a-zA-Z0-9_-]/g, '-');
	const tagDir = path.join(distDir, 'tag', sanitizedTag);

	<a key={tag} href={`/tag/${tag}`} className="tag-cloud-item">
	<a key={tag} href={`/tag/${encodeURIComponent(tag)}`} className="tag-cloud-item">

	const PagesComponents = ['404.html', 'about.html', 'tags.html'];
	const PagesComponents = ['404.html', 'about.html'];

Conversation

gapry commented Mar 28, 2026

Uh oh!

amazon-q-developer Bot left a comment

Choose a reason for hiding this comment

Code Review Summary

Critical Issues (Must Fix):

Required Changes:

Uh oh!

amazon-q-developer Bot Mar 28, 2026

Choose a reason for hiding this comment

Uh oh!

amazon-q-developer Bot Mar 28, 2026

Choose a reason for hiding this comment

Footnotes

Uh oh!

amazon-q-developer Bot Mar 28, 2026

Choose a reason for hiding this comment

Uh oh!

amazon-q-developer Bot Mar 28, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Mar 28, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Mar 28, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Mar 28, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Mar 28, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Mar 28, 2026

Choose a reason for hiding this comment

Uh oh!

gapry commented Mar 28, 2026

Uh oh!

gapry commented Mar 28, 2026

Uh oh!

amazon-q-developer Bot left a comment

Choose a reason for hiding this comment

Review Summary

Critical Issues (Must Fix)

Required Actions

Uh oh!

amazon-q-developer Bot Mar 28, 2026

Choose a reason for hiding this comment

Uh oh!

amazon-q-developer Bot Mar 28, 2026

Choose a reason for hiding this comment

Uh oh!

amazon-q-developer Bot Mar 28, 2026

Choose a reason for hiding this comment

Uh oh!

amazon-q-developer Bot Mar 28, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Mar 28, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Mar 28, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Mar 28, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Mar 28, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!