fix: handle PID 0 submission rows by boomzero · Pull Request #1013 · XMOJ-Script-dev/XMOJ-Script

boomzero · 2026-08-21T03:22:34Z

What does this PR aim to accomplish?:

Fixes the submission-history layout failure reported in #1012.

This is the same PID 0 edge case previously discussed in #16, which was closed without a defensive rendering fix.

How does this PR accomplish the above?:

PID 0 submission rows do not contain the usual resubmit anchor. The ResetType layout code previously accessed that missing anchor's .href, throwing an exception and stopping the remaining row transformations.

This change:

always renders the source link;
renders “重交” only when the resubmit anchor exists;
preserves the existing output for ordinary submission rows.

Static verification performed:

the complete userscript parses successfully;
the previous unsafe children[1].href dereference is absent;
the branch is one commit ahead of and zero commits behind dev;
only XMOJ.user.js is changed (6 additions, 1 deletion).

Browser verification is still needed for both the new and classic XMOJ interfaces, so this PR is intentionally opened as a draft.

By submitting this pull request, I confirm the following:

I have read and understood the contributor's guide and this template.
The non-obvious PID 0 condition is documented in the code.
Static checks have been completed; browser testing remains outstanding.
I am willing to help maintain this change if issues arise.
It is compatible with the GNU General Public License v3.0.
The change contains one focused commit.
I checked that no other open PR targets this issue.
The fix prevents one malformed row from breaking the entire submission table.
I accept that maintainers may decline the change.
The submission is given freely without ownership claims.
New/classic UI browser verification has not yet been completed.

I have read the above and my PR is ready for review. Left unchecked until browser verification is completed.

Summary by Sourcery

Handle PID 0 submission rows safely so one malformed row no longer interrupts submission-history rendering.

Bug Fixes:

Prevent submission-history rendering from failing when rows with PID 0 lack a resubmit link.
Preserve source-link rendering while showing the “重交” link only for submissions that support resubmission.

Build:

Bump the userscript and package versions to 3.6.2.

Chores:

Update release metadata in Update.json.

Summary by cubic

Fixes submission-history crashes for PID 0 rows by building links with the DOM and guarding a missing resubmit link. Previously we concatenated innerHTML and read children[1].href unconditionally; now we always render the source link and append “重交” only when a resubmit link exists, leaving normal rows unchanged.

Update XMOJ.user.js to use DOM-built anchors and a scoped null check for the resubmit link.
Bump version to 3.6.2 and refresh Update.json prerelease timestamp and notes; no config or migration required. Addresses [Bug] 提交记录若有显示题目id为0时会排版错乱 #1012.
Verify in classic and new UIs: PID 0 rows show only the source link; other rows show source + “重交”.

^{Written for commit b3b0aa4. Summary will update on new commits.}

sourcery-ai · 2026-08-21T03:22:56Z

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Implements a defensive layout fix for submission-history rows whose PID is 0 by always rendering the source-link cell and appending the “重交” resubmit link only when the underlying anchor exists, plus a minor version bump and update metadata changes.

File-Level Changes

Change	Details	Files
Make ResetType submission-row transformation robust when PID 0 rows lack a resubmit anchor while preserving existing layout for normal rows.	Replace direct access to the resubmit anchor href with a local variable pointing to Temp[i].childNodes[6].children[1]. Always render the source link cell content as an anchor to showsource.php with the solution ID. Add a conditional that appends the “重交” link only if the resubmit anchor node is non-null, preventing exceptions on PID 0 rows. Retain the subsequent DOM clean-up and formatting steps unchanged (removing the first/second cells, clearing class on the link, and normalizing size text).	`XMOJ.user.js`
Bump script/package versions and update release metadata for 3.6.2.	Update the userscript @Version header from 3.6.1 to 3.6.2. Update the npm package version field from 3.6.1 to 3.6.2. Add or extend the 3.6.2 prerelease entry in the update metadata JSON.	`XMOJ.user.js` `package.json` `Update.json`

Possibly linked issues

[Bug] 提交记录若有显示题目id为0时会排版错乱 #1012: PR updates XMOJ.user.js to safely handle PID 0 rows without resubmit links, fixing the issue’s layout bug.

Tips and commands

Interacting with Sourcery

Trigger a new review: Comment @sourcery-ai review on the pull request.
Continue discussions: Reply directly to Sourcery's review comments.
Generate a GitHub issue from a review comment: Ask Sourcery to create an
issue from a review comment by replying to it. You can also reply to a
review comment with @sourcery-ai issue to create an issue from it.
Generate a pull request title: Write @sourcery-ai anywhere in the pull
request title to generate a title at any time. You can also comment
@sourcery-ai title on the pull request to (re-)generate the title at any time.
Generate a pull request summary: Write @sourcery-ai summary anywhere in
the pull request body to generate a PR summary at any time exactly where you
want it. You can also comment @sourcery-ai summary on the pull request to
(re-)generate the summary at any time.
Generate reviewer's guide: Comment @sourcery-ai guide on the pull
request to (re-)generate the reviewer's guide at any time.
Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
pull request to resolve all Sourcery comments. Useful if you've already
addressed all the comments and don't want to see them anymore.
Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
request to dismiss all existing Sourcery reviews. Especially useful if you
want to start fresh with a new review - don't forget to comment
@sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

Enable or disable review features such as the Sourcery-generated pull request
summary, the reviewer's guide, and others.
Change the review language.
Add, remove or edit custom review instructions.
Adjust other review settings.

Getting Help

Contact our support team for questions or feedback.
Visit our documentation for detailed guides and information.
Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

cloudflare-workers-and-pages · 2026-08-21T03:23:07Z

Deploying xmoj-script-dev-channel with Cloudflare Pages

Latest commit:	`b3b0aa4`
Status:	✅ Deploy successful!
Preview URL:	https://c63034b2.xmoj-script-dev-channel.pages.dev
Branch Preview URL:	https://fix-status-pid-zero-layout.xmoj-script-dev-channel.pages.dev

View logs

boomzero · 2026-08-21T03:27:03Z

If anyone could test this, I am sure my AI agent will fix all the issues you find

zsTree0830

fixed

sourcery-ai

Hey - I've found 4 security issues, and left some high level feedback:

Security issues:

User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities (link)
User controlled data in a Temp[i].childNodes[0].innerHTML is an anti-pattern that can lead to XSS vulnerabilities (link)
User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities (link)
User controlled data in a Temp[i].childNodes[0].innerHTML is an anti-pattern that can lead to XSS vulnerabilities (link)

General comments:

Given this is hardening around malformed rows, consider also guarding Temp[i].childNodes[6] before accessing .children[1] (or using optional chaining) so that unexpected table structures don’t cause a new runtime error at resubmitLink initialization.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- Given this is hardening around malformed rows, consider also guarding `Temp[i].childNodes[6]` before accessing `.children[1]` (or using optional chaining) so that unexpected table structures don’t cause a new runtime error at `resubmitLink` initialization.

## Individual Comments

### Comment 1
<location path="XMOJ.user.js" line_range="3506" />
<code_context>
                                Temp[i].childNodes[0].innerHTML = "<a href=\"https://www.xmoj.tech/showsource.php?id=" + SID + "\">" + SID + "</a>";
</code_context>
<issue_to_address>
**security (javascript.browser.security.insecure-document-method):** User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities

*Source: opengrep*
</issue_to_address>

### Comment 2
<location path="XMOJ.user.js" line_range="3506" />
<code_context>
                                Temp[i].childNodes[0].innerHTML = "<a href=\"https://www.xmoj.tech/showsource.php?id=" + SID + "\">" + SID + "</a>";
</code_context>
<issue_to_address>
**security (javascript.browser.security.insecure-innerhtml):** User controlled data in a `Temp[i].childNodes[0].innerHTML` is an anti-pattern that can lead to XSS vulnerabilities

*Source: opengrep*
</issue_to_address>

### Comment 3
<location path="XMOJ.user.js" line_range="3509" />
<code_context>
                                    Temp[i].childNodes[0].innerHTML += " <a href=\"" + resubmitLink.href + "\">重交</a>";
</code_context>
<issue_to_address>
**security (javascript.browser.security.insecure-document-method):** User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities

*Source: opengrep*
</issue_to_address>

### Comment 4
<location path="XMOJ.user.js" line_range="3509" />
<code_context>
                                    Temp[i].childNodes[0].innerHTML += " <a href=\"" + resubmitLink.href + "\">重交</a>";
</code_context>
<issue_to_address>
**security (javascript.browser.security.insecure-innerhtml):** User controlled data in a `Temp[i].childNodes[0].innerHTML` is an anti-pattern that can lead to XSS vulnerabilities

*Source: opengrep*
</issue_to_address>

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

cubic-dev-ai

No issues found across 3 files

_{Re-trigger cubic}

boomzero · 2026-08-21T04:31:31Z

Addressed the review feedback in f64d95c:

replaced both innerHTML operations with DOM node construction;
guarded the parent cell with optional chaining before reading the resubmit anchor;
retained the existing output for normal rows.

The complete userscript still passes syntax validation. Waiting for the updated preview deployment and a quick reporter retest.

cubic-dev-ai

1 issue found across 2 files (changes from recent commits).

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="XMOJ.user.js">

<violation number="1" location="XMOJ.user.js:3505">
P2: If the malformed PID 0 row is missing a cell node, this optional chaining only moves the crash: the same block then dereferences `Temp[i].childNodes[6].innerText`, `childNodes[5]`, and `childNodes[9]` unconditionally, so the row can still throw and break the table. Only `children[1]` being absent was already handled by the old null-guard, so the only scenario this PR can actually change is a missing `childNodes[6]` — which the later `Temp[i].childNodes[6].innerText = CodeSizeToStringSize(...)` line still crashes on. Guard the whole cell access (e.g. `childNodes[6]?.innerText`) or take a per-cell defensive path so a single malformed row cannot abort the loop.</violation>
</file>

_{Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic}

cubic-dev-ai · 2026-08-21T04:41:15Z

                            if (UtilityEnabled("ResetType")) {
                                Temp[i].childNodes[0].remove();
-                                Temp[i].childNodes[0].innerHTML = "<a href=\"https://www.xmoj.tech/showsource.php?id=" + SID + "\">" + SID + "</a> " + "<a href=\"" + Temp[i].childNodes[6].children[1].href + "\">重交</a>";
+                                let resubmitLink = Temp[i].childNodes[6]?.children[1];


P2: If the malformed PID 0 row is missing a cell node, this optional chaining only moves the crash: the same block then dereferences Temp[i].childNodes[6].innerText, childNodes[5], and childNodes[9] unconditionally, so the row can still throw and break the table. Only children[1] being absent was already handled by the old null-guard, so the only scenario this PR can actually change is a missing childNodes[6] — which the later Temp[i].childNodes[6].innerText = CodeSizeToStringSize(...) line still crashes on. Guard the whole cell access (e.g. childNodes[6]?.innerText) or take a per-cell defensive path so a single malformed row cannot abort the loop.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At XMOJ.user.js, line 3505: <comment>If the malformed PID 0 row is missing a cell node, this optional chaining only moves the crash: the same block then dereferences `Temp[i].childNodes[6].innerText`, `childNodes[5]`, and `childNodes[9]` unconditionally, so the row can still throw and break the table. Only `children[1]` being absent was already handled by the old null-guard, so the only scenario this PR can actually change is a missing `childNodes[6]` — which the later `Temp[i].childNodes[6].innerText = CodeSizeToStringSize(...)` line still crashes on. Guard the whole cell access (e.g. `childNodes[6]?.innerText`) or take a per-cell defensive path so a single malformed row cannot abort the loop.</comment> <file context> @@ -3502,11 +3502,19 @@ async function main() { Temp[i].childNodes[0].remove(); - let resubmitLink = Temp[i].childNodes[6].children[1]; - Temp[i].childNodes[0].innerHTML = "<a href=\"https://www.xmoj.tech/showsource.php?id=" + SID + "\">" + SID + "</a>"; + let resubmitLink = Temp[i].childNodes[6]?.children[1]; + let sourceCell = Temp[i].childNodes[0]; + let sourceLink = document.createElement("a"); </file context>

boomzero · 2026-08-21T05:36:22Z

Addressed Cubic’s P2 observation in eb3b9bf.

The reported PID 0 row is not missing the entire cell; it is missing the second child anchor (children[1]) inside the existing cell. The previous optional chaining implied support for a missing cell even though later formatting correctly requires the normal row schema. The guard is now scoped explicitly to the missing resubmit link (children[1] ?? null).

The DOM-node construction that removed the innerHTML/XSS findings remains unchanged, and the complete userscript still passes syntax validation.

fix: handle PID 0 submission rows

14498fa

pull-request-size Bot added the size/XS label Aug 21, 2026

hendragon-bot Bot added the user-script This issue or pull request is related to the main user script label Aug 21, 2026

github-actions Bot added 2 commits August 21, 2026 03:22

3.6.2

3b1c60f

Update version info to 3.6.2

811e84d

pull-request-size Bot added size/S and removed size/XS labels Aug 21, 2026

boomzero mentioned this pull request Aug 21, 2026

[Bug] 提交记录若有显示题目id为0时会排版错乱 #1012

Closed

2 tasks

zsTree0830 approved these changes Aug 21, 2026

View reviewed changes

zsTree0830 marked this pull request as ready for review August 21, 2026 03:33

sourcery-ai Bot reviewed Aug 21, 2026

View reviewed changes

Comment thread XMOJ.user.js Outdated

Comment thread XMOJ.user.js Outdated

Comment thread XMOJ.user.js Outdated

Comment thread XMOJ.user.js Outdated

zsTree0830 linked an issue Aug 21, 2026 that may be closed by this pull request

[Bug] 提交记录若有显示题目id为0时会排版错乱 #1012

Closed

2 tasks

cubic-dev-ai Bot reviewed Aug 21, 2026

View reviewed changes

refactor: build submission links safely

f64d95c

pull-request-size Bot added size/M and removed size/S labels Aug 21, 2026

Update time and description of 3.6.2

37c9ef2

cubic-dev-ai Bot reviewed Aug 21, 2026

View reviewed changes

fix: scope guard to missing resubmit link

eb3b9bf

Update time and description of 3.6.2

b3b0aa4

boomzero merged commit 2e7229e into dev Aug 21, 2026
11 checks passed

boomzero deleted the fix/status-pid-zero-layout branch August 21, 2026 06:22

boomzero mentioned this pull request Sep 19, 2026

Sync Dev #1024

Merged

12 tasks

Conversation

boomzero commented Aug 21, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by Sourcery

Summary by cubic

Uh oh!

sourcery-ai Bot commented Aug 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviewer's Guide

File-Level Changes

Possibly linked issues

Interacting with Sourcery

Customizing Your Experience

Getting Help

Uh oh!

cloudflare-workers-and-pages Bot commented Aug 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying xmoj-script-dev-channel with Cloudflare Pages

Uh oh!

boomzero commented Aug 21, 2026

Uh oh!

zsTree0830 left a comment

Choose a reason for hiding this comment

Uh oh!

sourcery-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

boomzero commented Aug 21, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot Aug 21, 2026

Choose a reason for hiding this comment

Uh oh!

boomzero commented Aug 21, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

boomzero commented Aug 21, 2026 •

edited by cubic-dev-ai Bot

Loading

sourcery-ai Bot commented Aug 21, 2026 •

edited

Loading

cloudflare-workers-and-pages Bot commented Aug 21, 2026 •

edited

Loading