feat(builder): add autoSet and localization for commands#60
Conversation
- Add autoSet methods to command builders for automatic name/description - Implement localization utility for commands and options - Add report command with localized strings in en-US and tr - Update ping command to use autoSet and new builder structure - Extend context with getDefaultLocalization method
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly upgrades the command building experience by introducing automatic naming and description setting for command components, alongside comprehensive localization support. These changes simplify command definition and enable a more internationalized user experience by allowing command elements to adapt to different languages. The refactoring also improves the internal handling of command execution contexts and locale resolution, making the system more robust and easier to extend. Highlights
Changelog
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
There was a problem hiding this comment.
Code Review
This pull request introduces some valuable refactoring to the command and context builders, aiming to reduce code duplication and improve structure, especially around command execution handlers and localization. While the overall direction is good, there's a critical logic flaw in the new createContextHandler method that could lead to unexpected behavior by executing both a primary and a fallback handler for the same event. Additionally, there's an opportunity to simplify some of the new localization logic for better readability. Addressing these points will help ensure the new abstractions are both robust and maintainable.
…ariable' Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>
Enforce Discord's requirement that commands do not mix subcommands or subcommand groups with regular options at the top level. An error is now thrown if both are present.
- Add resolveInteractionCommand and resolveMessageCommand to support localized and aliased command names - Refactor event handlers to use new resolution methods - Remove unused "hello" keys from test.json locales - Expose getDefaultLocalization in context JSON
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request introduces a powerful "autoSet" feature for command builders and robust localization support. However, it also introduces significant performance issues and a potential for Discord mention injection. The command resolution logic repeatedly performs expensive localization operations, which could lead to Denial of Service, and user-provided usernames are not sanitized, allowing for mention injection when escapeValue: false is used. Additionally, critical issues were found, including missing properties in the ApplicationCommandBuilder's toJSON method and a bug in the new localization logic that can produce invalid command names. There's also a potential feature regression with command aliases and opportunities for code clarity improvements.
- Add MessageCommandParser for parsing message commands with localization and fuzzy matching - Extend Context to support localization aliases - Update example commands and locales to use aliases - Add fastest-levenshtein dependency for fuzzy matching
BREAKING CHANGE: Command aliases are no longer supported. The `aliases` property and related logic have been removed. Command lookup is now based solely on command names and their localizations. Update any code or configuration relying on aliases to use command names instead.
- Removes manual username interpolation in report command
- Updates locale files to use {{user.name}} and {{author.name}} tokens
- Adds context-aware token resolution to Context.t()
- Centralizes Discord text sanitization and template parsing
- Add template parser registration to Client - Allow custom template token resolution in Context - Expose i18next.parser API for managing parsers
|
/gemini review |
Replaces regex-based parsing with manual parsing to better handle malformed or nested template tokens
There was a problem hiding this comment.
Code Review
This pull request introduces significant enhancements by adding an autoSet feature for command builders and a comprehensive localization system for commands, along with substantial refactoring of command resolution and builders. However, it introduces two significant security issues: a template injection vulnerability in the translation system that could lead to information disclosure (due to user-supplied interpolation values being processed by a custom template parser, allowing injection and evaluation of bot-internal tokens), and missing access control in the report command example, which allows any user to trigger administrative subcommands. Additionally, areas for improvement include handling command alias conflicts and a bug in the new message command parser that prevents 0 from being a valid option value.
- Prevent resolving tokens not present in the translation string - Add collectTemplateTokens utility to extract allowed tokens - Improve command lookup conflict logging - Allow zero as valid value in MessageCommandParser
No description provided.