Skip to content

fix: restrict search inputs - #2078

Open
calebwongg wants to merge 8 commits into
mainfrom
cwong/restrict-search-inputs
Open

calebwongg wants to merge 8 commits into
mainfrom
cwong/restrict-search-inputs

Conversation

@calebwongg

@calebwongg calebwongg commented Nov 4, 2026 •

Copy link
Copy Markdown
Contributor

Summary

Restricts what can be typed into three manual search fields so invalid characters are dropped on input instead of being sent to the API. Section Code keeps digits plus commas, hyphens, and spaces so comma lists and ranges like 29000-29100 still work. Instructor rejects digits, and Units accepts either a number or the literal VAR, typed letter by letter.

Screenshots

Test Plan

use nuqs to verify sanitizing

  • Section Code: type 1a4b2c and see 142. Type 14200, 29000-29100 and confirm it's accepted and the search returns results for the range.
  • Instructor: type letters with numbers and see only letters
  • Units: type v, a, r one at a time and see VAR. Type VAR4 or VARX and see VAR. Type 4 and see 4. Type x into an empty field and see nothing.
  • Paste a bad value into each field and confirm it's sanitized the same as typing.

Issues

Closes #2065

View guided diff

@github-actions github-actions Bot added the Scheduler AntAlmanac Scheduler label Nov 4, 2026
@calebwongg
calebwongg marked this pull request as draft November 4, 2026 09:45

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cubic analysis

No issues found across 3 files

Linked issue analysis

Linked issue: icssc/AntAlmanac#2065: Restrict search field inputs

Status Acceptance criteria Notes
⚠️ Allow numbers only in the section code The handler removes other characters but still permits commas and hyphens, so it is not numbers-only.
✅ Disallow numbers in instructor names InstructorField strips every digit on change while leaving names with punctuation intact.
✅ Allow numbers or the correctly ordered VAR exception for units UnitsField accepts digits and the VAR prefix sequence, normalizing letters to uppercase.

View guided diff | Re-trigger cubic

@calebwongg

Copy link
Copy Markdown
Contributor Author

/deploy

@calebwongg
calebwongg marked this pull request as ready for review November 5, 2026 02:35
Comment on lines +13 to +23
onChange: (event) => {
const upper = event.target.value.toUpperCase();

if (upper.startsWith('VAR')) {
setUnits('VAR');
} else if ('VAR'.startsWith(upper)) {
setUnits(upper);
} else {
setUnits(upper.replace(/[^0-9]/g, ''));
}
},

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we need to preserve decimal points here as well, there are cases where a course's units can include a decimal point

Image

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

1 issue found across 1 file (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/antalmanac-scheduler/site/src/components/RightPane/CoursePane/SearchForm/ManualSearch/AdvancedSearch/AdvancedSearchFields/UnitsField.tsx">

<violation number="1" location="apps/antalmanac-scheduler/site/src/components/RightPane/CoursePane/SearchForm/ManualSearch/AdvancedSearch/AdvancedSearchFields/UnitsField.tsx:21">
P2: This regex keeps every decimal point, so inputs such as `1.2.3` and `..` are accepted even though they are not numbers. Retain at most one decimal point so malformed pasted values cannot be sent as the `units` query.</violation>
</file>

Tip: Get a Slack DM when cubic finishes reviewing your PRs. Connect Slack

View guided diff | Re-trigger cubic

} else if ('VAR'.startsWith(upper)) {
setUnits(upper);
} else {
setUnits(upper.replace(/[^0-9.]/g, ''));

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: This regex keeps every decimal point, so inputs such as 1.2.3 and .. are accepted even though they are not numbers. Retain at most one decimal point so malformed pasted values cannot be sent as the units query.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At apps/antalmanac-scheduler/site/src/components/RightPane/CoursePane/SearchForm/ManualSearch/AdvancedSearch/AdvancedSearchFields/UnitsField.tsx, line 21:

<comment>This regex keeps every decimal point, so inputs such as `1.2.3` and `..` are accepted even though they are not numbers. Retain at most one decimal point so malformed pasted values cannot be sent as the `units` query.</comment>

<file context>
@@ -18,7 +18,7 @@ export const UnitsField = memo(() => {
                         setUnits(upper);
                     } else {
-                        setUnits(upper.replace(/[^0-9]/g, ''));
+                        setUnits(upper.replace(/[^0-9.]/g, ''));
                     }
                 },
</file context>

@calebwongg

Copy link
Copy Markdown
Contributor Author

/deploy

@Choollol

Copy link
Copy Markdown
Collaborator

@calebwongg pull main it has fixes for the type errors blocking deployments

@calebwongg

Copy link
Copy Markdown
Contributor Author

hooray

@calebwongg
calebwongg requested a review from sicn4rf November 11, 2026 17:47
Comment on lines +13 to +23
onChange: (event) => {
const upper = event.target.value.toUpperCase();

if (upper.startsWith('VAR')) {
setUnits('VAR');
} else if ('VAR'.startsWith(upper)) {
setUnits(upper);
} else {
const cleaned = upper.replace(/[^0-9.]/g, '');
const finalValue = cleaned.replace(/(\..*?)\./g, '$1');
setUnits(finalValue);

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is it intended that typing a number or dot resets the VAR progress? For example typing V, A, 1 shows V, VA, 1

This branch was successfully deployed

1 active deployment
staging-2078 — ed3720b4 Deployed Nov 11, 2026 by github-actions[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Scheduler AntAlmanac Scheduler

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Restrict search field inputs

3 participants