Review Everywhere
The only tool that reviews everywhere you work.
Review at the PR stage or directly in your IDE & CLI. Catch security flaws, bugs, and design issues — no matter where you code.
MESRAI
Mesrai
@mesraiofficialFREEmesraiofficial
Reviews: 8993 / 100000
Review completed
UncommittedCurrent FileUnpushedStaged
1 files · 7 findings · 39s · 338 tokens
AI SuggestionsStatic Analysis
login.tsx7
HIGHsecurity
URL parameter injection vulnerability
The code directly uses URL search parameters without sanitization, which could lead to XSS attacks.
Suggested Fix: Sanitize the error message before displaying it.
BEFORE
398
const errorMessage = searchParams.get("error");AFTER
398
const errorMessage = DOMPurify.sanitize( searchParams.get('error') ?? '');security · L398 · 72% confidence
Go to line 398
2 / 7
package.json
README.md
login.tsx 5
apps > web > src > pages > login.tsx > …
394const AuthSection = memo(() => {
395 const [mounted, setMounted] = useState(false);
396 const searchString = useSearch();
397 const searchParams = new URLSearchParams(searchString);
398 const errorMessage = searchParams.get("error");
High: Security
Mesrainow High
● High — URL parameter injection vulnerability
Uses URL search parameters without sanitization. Could lead to XSS attacks.
Suggested Fix: Sanitize the error message before displaying.
Before:
searchParams.get("error")
After:
DOMPurify.sanitize(…)
399 const [showError, setShowError] = useState(!!errorMessage);
400
401 useEffect(() => {
402 setMounted(true);
403 }, []);
PROBLEMS 6OUTPUTTERMINALCOMMENTS 7
Mesrai now ·Medium — Missing Content Security Policy headers[Ln 34-37]
Mesrai now ·Medium — Potential XSS in dynamic class concatenation[Ln 88]
Mesrai now ·Medium — Potential SSR hydration mismatch[Ln 394-414]
mesrai-cde-develop-v1*⊘ 2 ⚠ 3 ⓘ 1
Mesrai (7)TypeScript JSXUTF-8
Install VS Code Extension
Free forever
VS Code only (for now)
No credit card