[1.0.x] Error Reporting

Thank you for applying!

Please read Review process for security advisory coverage: What to expect for more details and Security advisory coverage application checklist to understand what reviewers look for. Tips for ensuring a smooth review gives some hints for a smoother review.

The important notes are the following.

• If you have not done it yet, you should run phpcs --standard=Drupal,DrupalPractice on the project, which alone fixes most of what reviewers would report.
• For the time this application is open, only your commits are allowed.
• The purpose of this application is giving you a new drupal.org role that allows you to opt projects into security advisory coverage, either projects you already created, or projects you will create. The project status won't be changed by this application and no other user will be able to opt projects into security advisory policy.
• We only accept an application per user. If you change your mind about the project to use for this application, or it is necessary to use a different project for the application, please update the issue summary with the link to the correct project and the issue title with the project name and the branch to review.

To the reviewers

Please read How to review security advisory coverage applications, Application workflow, What to cover in an application review, and Tools to use for reviews.

The important notes are the following.

• It is preferable to wait for a Code Review Administrator before commenting on newly created applications. Code Review Administrators will do some preliminary checks that are necessary before any change on the project files is suggested.
• Reviewers should show the output of a CLI tool only once per application.
• It may be best to have the applicant fix things before further review.

For new reviewers, I would also suggest to first read In which way the issue queue for coverage applications is different from other project queues.

For these applications, we need a project where, in at least the branch used for the application, most of the commits (if not all the commits) have been done from the user who applies.
The purpose of these applications is reviewing a project to understand what the person who applies understands about writing secure code that follows the Drupal coding standards and correctly uses the Drupal API, not what all the project maintainers collectively understand about those points.

In this case, all the commits (five) have been done by sunil_lnwebworks.

This application can only continue with a project (and a branch) where all the commits (or the majority of the commits) have been done by you.

Code looks good but I found these errors. You don't have a LICENSE.txt.

FILE: /var/www/html/global/web/modules/contrib/error_reporting/libraries/js/error_reporting.js
-------------------------------------------------------------------------------------------------
FOUND 27 ERRORS AFFECTING 12 LINES
-------------------------------------------------------------------------------------------------
2 | ERROR | [x] TRUE, FALSE and NULL must be uppercase; expected "NULL" but found "null"
13 | ERROR | [x] Expected 1 space before "<"; 0 found
13 | ERROR | [x] Expected 1 space after "<"; 0 found
13 | ERROR | [x] Expected 1 space before "="; 0 found
13 | ERROR | [x] Expected 1 space after "="; 0 found
13 | ERROR | [x] Expected 1 space before "-"; 0 found
13 | ERROR | [x] Expected 1 space after "-"; 0 found
13 | ERROR | [x] Expected 1 space before "="; 0 found
13 | ERROR | [x] Expected 1 space after "="; 0 found
13 | ERROR | [x] Expected 1 space before ">"; 0 found
13 | ERROR | [x] Expected 1 space after ">"; 0 found
13 | ERROR | [x] Expected 1 space before "<"; 0 found
13 | ERROR | [x] Expected 1 space after "<"; 0 found
13 | ERROR | [x] Expected 1 space before "/"; 0 found
13 | ERROR | [x] Expected 1 space after "/"; 0 found
13 | ERROR | [x] Expected 1 space before ">"; 0 found
13 | ERROR | [x] Expected 1 space after ">"; 0 found
73 | ERROR | [x] Expected 1 space after FUNCTION keyword; 0 found
75 | ERROR | [x] TRUE, FALSE and NULL must be uppercase; expected "FALSE" but found "false"
79 | ERROR | [x] TRUE, FALSE and NULL must be uppercase; expected "TRUE" but found "true"
84 | ERROR | [x] Functions must not contain multiple empty lines in a row; found 2 empty lines
88 | ERROR | [x] TRUE, FALSE and NULL must be uppercase; expected "TRUE" but found "true"
97 | ERROR | [x] TRUE, FALSE and NULL must be uppercase; expected "TRUE" but found "true"
105 | ERROR | [x] TRUE, FALSE and NULL must be uppercase; expected "TRUE" but found "true"
113 | ERROR | [x] TRUE, FALSE and NULL must be uppercase; expected "TRUE" but found "true"
118 | ERROR | [x] Whitespace found at end of line
119 | ERROR | [x] Expected 1 newline at end of file; 0 found
-------------------------------------------------------------------------------------------------
PHPCBF CAN FIX THE 27 MARKED SNIFF VIOLATIONS AUTOMATICALLY
-------------------------------------------------------------------------------------------------

Time: 9.36 secs; Memory: 10MB

Needs Work

It is preferable to not use PHP_CodeSniffer for JavaScript files. It would try to apply PHP rules to JavaScript files, even when those are not correct; for example, it would report that NULL must be used, while null, true, and false are used in JavaScript code.

I am changing the issue priority as per issue priorities.

// Set a custom exception handler.
set_exception_handler('error_reporting_exception_handler');

/**
 * Custom exception handler function.
 */
function error_reporting_exception_handler(\Throwable $exception) {
  // Get the container.
  $container = \Drupal::getContainer();

  // Get the config service.
  $config = $container->get('config.factory')->get('error_reporting.settings')->get('enable_error_reporting');

  // If custom error reporting is disabled, let Drupal handle the exception.
  if (!$config) {
    // Create a Symfony Response object with a 500 status code and send it.
    $response = new Response('The website encountered an unexpected error. Please try again later.', Response::HTTP_INTERNAL_SERVER_ERROR);
    $response->send();
    return;
  }

The code says that if error reporting is disabled that it lets Drupal handle the exception, but that's not what it actually does. In order to let Drupal handle it, this code would need to call Drupal's handler, right?

_drupal_exception_handler($exception);

Also, when the module is being uninstalled, you shouldn't need to update a config value, since the module's config is deleted when it is uninstalled.

/**
 * Implements hook_uninstall().
 *
 * Disable error reporting configuration for the module.
 */
function error_reporting_uninstall() {
  // Get the configuration service.
  $config = \Drupal::configFactory();

  // Set the 'enable_error_reporting' configuration value to FALSE.
  $config->getEditable('error_reporting.settings')
    ->set('enable_error_reporting', FALSE)
    ->save();
}

The twig template hardcodes CDN links to 3rd party libraries:

    <!-- Highlight.js -->
    <script src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.6.0/highlight.min.js"></script>
    <link rel="stylesheet" href="//cdnjs.cloudflare.com/ajax/libs/highlight.js/10.0.3/styles/default.min.css" />
    <link rel="stylesheet" href="//cdnjs.cloudflare.com/ajax/libs/highlight.js/10.0.3/styles/atom-one-light.min.css" />
    <script src="https://cdn.jsdelivr.net/gh/TRSasasusu/highlightjs-highlight-lines.js@1.1.5/highlightjs-highlight-lines.min.js"></script>

    <!-- Font Awesome -->
    <link href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0/css/all.min.css" rel="stylesheet" />

    <!-- Google Fonts -->
    <link href="https://fonts.googleapis.com/css?family=Roboto:300,400,500,700&display=swap" rel="stylesheet" />

    <!-- MDB -->
    <link href="https://cdnjs.cloudflare.com/ajax/libs/mdb-ui-kit/4.4.0/mdb.min.css" rel="stylesheet" />
    <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/mdb-ui-kit/4.4.0/mdb.min.js"></script>

    <!-- jQuery -->
    <script src="https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js"></script>

    <!-- DOMPurify -->
    <script src="https://cdn.jsdelivr.net/npm/dompurify@2.2.9/dist/purify.min.js"></script>

This is a bad way to do it (because the versions could be found to have a vulnerability later, but neither Drupal nor Composer will see the module is using an old version.) Use Drupal's library system instead, and include dependencies in a composer.json file (which the project doesn't currently have).

Similarly, the JS file error_reporting.js should use Drupal's JS behaviors system. For examples, you could look at the Paragraphs module: https://git.drupalcode.org/project/paragraphs/-/blob/8.x-1.x/js/paragrap...

I am changing priority as per Issue priorities.

This thread has been idle, in the Needs work state with no activity for several months. Therefore, I am assuming that you are no longer pursuing this application, and I marked it as Closed (won't fix).

If this is incorrect, and you are still pursuing this application, then please feel free to re-open it and set the issue status to Needs work or Needs review, depending on the current status of your code.

This thread has been idle, in the Needs work state with no activity for more than eight months; the application has been created more than 11 months ago. Therefore, I marked it as Closed (won't fix).

If this is incorrect, and you are still pursuing this application, please feel free to re-open it and set the issue status to Needs work or Needs review, depending on the current status of your code.