Skip to content

fix: safely parse portal URL hash params to prevent crash#26910

Merged
9larsons merged 2 commits into
TryGhost:mainfrom
Rohit7241:fix-safe-json-parse-portal
Jun 7, 2026
Merged

fix: safely parse portal URL hash params to prevent crash#26910
9larsons merged 2 commits into
TryGhost:mainfrom
Rohit7241:fix-safe-json-parse-portal

Conversation

@Rohit7241

@Rohit7241 Rohit7241 commented Mar 22, 2026

Copy link
Copy Markdown
Contributor

🐛 Fixed portal URL hash parsing to prevent crash

closes #26399

The previous implementation of parsing URL hash parameters could
throw errors if the hash was malformed or missing. This change
introduces a safe JSON parse utility that ensures invalid or empty
hashes do not crash the portal. This improves stability and prevents
unexpected runtime errors for users navigating with unusual URLs.

@cursor

cursor Bot commented Mar 22, 2026

Copy link
Copy Markdown

You have used all of your free Bugbot PR reviews.

To receive reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

@coderabbitai

coderabbitai Bot commented Mar 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Walkthrough

The change introduces a safeJSONParse() helper function in apps/portal/src/app.js that wraps JSON parsing in a try/catch block and logs warnings instead of throwing errors. All direct JSON.parse() calls processing URL query parameters—including button, name, portal_signup_checkbox_required, disableBackground, and transistorPortalSettings—were replaced with this helper. Boolean plan flag handling (isFree, isMonthly, isYearly) was adjusted to use the safe parser in conditional checks. The updateStateForPreviewLinks() function was also wrapped in try/catch to handle failures during preview data fetching and state updates.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title 'fix: safely parse portal URL hash params to prevent crash' directly and clearly summarizes the main change: introducing safe JSON parsing for portal URL hash parameters to prevent crashes.
Description check ✅ Passed The description explains the fix for portal URL hash parsing, references the linked issue, and describes the improvements to stability—all directly related to the changeset.
Linked Issues check ✅ Passed The PR addresses all objectives from issue #26399: implements a safeJSONParse wrapper for the nine parameters, protects both initial load and hashchange paths, and adds error handling to updateStateForPreviewLinks().
Out of Scope Changes check ✅ Passed All changes in the PR are scoped to fixing the JSON parsing crash issue in apps/portal/src/app.js with no unrelated modifications.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

coderabbitai[bot]
coderabbitai Bot reviewed Mar 22, 2026
View reviewed changes

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents 
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@apps/portal/src/app.js`:
- Around line 29-37: In safeJSONParse, replace the incorrect JSON.Parse call
with the correct JSON.parse to avoid the TypeError and allow valid JSON to
parse; update the return statement inside the try block to call
JSON.parse(value) (leaving fallback behavior and the warning in the catch
unchanged) and run a quick smoke test to confirm valid URL JSON now returns
parsed objects from safeJSONParse.
ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 922cbdf1-8266-4144-8353-41bdb1ca2586

📥 Commits

Reviewing files that changed from the base of the PR and between 248fe42 and ed640ae.

📒 Files selected for processing (1)
  • apps/portal/src/app.js

Comment thread apps/portal/src/app.js Outdated
@9larsons 9larsons force-pushed the fix-safe-json-parse-portal branch 5 times, most recently from 7ef1a87 to 9d8a4cf Compare June 7, 2026 01:19
@Rohit7241 @9larsons
🐛 Fixed Portal crash on malformed preview URL hash params
587286c 
closes TryGhost#26399

`fetchQueryStrData()` parses several preview hash params with
`JSON.parse()` (`button`, `name`, `isFree`, `isMonthly`, `isYearly`,
`signupCheckboxRequired`, `disableBackground`, `transistorPortalSettings`).
A malformed value (e.g. `#/portal/preview?button={INVALID`) threw a
`SyntaxError`: on initial load this was swallowed by `initSetup()` and
left the widget unrendered, and on the `hashchange` path it rejected
uncaught inside `updateStateForPreviewLinks()`.

This code only runs in Portal preview mode (the Admin settings-preview
iframe, or a hand-crafted `#/portal/preview` link), so a bad hash should
never interrupt rendering. Wrapped the parse in `fetchPreviewData()` —
the single boundary both paths go through — in a try/catch that reports
the error to Sentry and renders without preview data. Added regression
tests for the malformed and valid hashes.
@9larsons 9larsons force-pushed the fix-safe-json-parse-portal branch from 9d8a4cf to 587286c Compare June 7, 2026 22:38
@9larsons

9larsons commented Jun 7, 2026

Copy link
Copy Markdown
Contributor

Hey @Rohit7241, I made some adjustments. We have stayed away from using console.warn and as that's just noise for developers and instead fail in a way we can track it, or throw. In this case, throwing is bad, so we'll leverage Sentry. Thanks for the PR!

@9larsons 9larsons enabled auto-merge (squash) June 7, 2026 22:42
@9larsons 9larsons merged commit d199fe9 into TryGhost:main Jun 7, 2026
45 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@coderabbitai coderabbitai[bot] coderabbitai[bot] left review comments
@9larsons 9larsons 9larsons approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Unhandled JSON.parse() exceptions in Portal's fetchQueryStrData() crash widget on malformed preview URLs

2 participants

@Rohit7241 @9larsons