feat(project): add project management features including pressbook im… by yghaemi · Pull Request #785 · LibreTexts/conductor

yghaemi · 2026-05-06T14:07:58Z

Features added:

Pressbook importer
Remixer version 3

Consideration: package-lock.json was not added to avoid a merge conflict.

…port and remixer.

aikido-pr-checks · 2026-05-06T14:09:17Z

+async function appendPressbooksJobMessages(jobID: string, messages: string[]) {
+  if (!messages.length) return;
+  await PressbooksImportJob.updateOne(
+    { jobID },


NoSQL injection attack possible - critical severity
Query injection attacks are possible if users can pass objects instead of strings to query functions such as findOne.

By injecting query operators attackers can control the behavior of the query, allowing them to bypass access controls and extract unauthorized data. Consider the attack payload ?user_id[$ne]=5: if the user_id query parameter is passed to the query function without validation or casting its type, an attacker can pass {$ne: 5} instead of an integer to the query. {$ne: 5} uses the 'not equal to' operator to access data of other users.

While this vulnerability is known as NoSQL injection, relational databases (mysql, postgres) are also vulnerable to this attack if the query library offers a NoSQL-like API and supports string-typed query operators. Examples include prisma and sequelize versions prior to 4.12.0.

Show fix

Remediation: User input should be validated (e.g. with class-validator, zod or joi) or sanitized (e.g. with mongo-sanitize). Alternatively cast request parameters to their expected type or use the $eq operator to block object injection. You can also Autofix all instances of NoSQL injection by installing Zen for Node.js.

_{Reply @AikidoSec ignore: [REASON] to ignore this issue.}
_{More info}

github-advanced-security

CodeQL found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.

…xer API endpoints

jakeaturner

Hey @yghaemi tons of great work here!! Left a few comments (not all of them need to be addressed right now), but in general my only other concern is that we are migrating all of Conductor to Davis Design, which means we'll need to migrate these new Remixer components eventually, too. It may be easier to do so now before it goes to prod. But, for staging, it's not a concern -- I know we are anxious to start playing around with it and, as far as I can tell, the core functionality looks solid

jakeaturner · 2026-05-07T17:24:55Z

+  } | null>(null);
+  const user = useTypedSelector((state) => state.user);
+
+  useEffect(() => {


In a perfect world, we'd use useQuery from @tanstack/react-query here for consistency across the codebase, but it's certainly not a blocker for staging

jakeaturner · 2026-05-07T17:29:09Z

@@ -0,0 +1,158 @@
+import { Book, MasterCatalogV2Response } from "../../types";
+
+export type Library = "bio" | "biz" | "chem" | "dev" | "eng" | "espanol" | "geo" | "human" | "k12" | "math" | "med" | "phys" | "socialsci" | "stats" | "workforce";


Will be best to use the LIBRARIES constant in client\src\utils\constants.ts for a single source of truth, but this can be addressed in a subsequent PR

jakeaturner · 2026-05-07T17:33:44Z

+
+    const interval = setInterval(async () => {
+      try {
+        const res = await axios.get(`/commons/import-pressbooks/${jobID}`);


Recommend switching to useMutation from @tanstack/react-query in a subsequent PR for cleaner request state management and consistency

Also will want to make sure we define all request paths in client\src\api.ts and consume them as, for example, api.getPressbooksImportJob()

jakeaturner · 2026-05-07T17:37:10Z

+        <Modal.Header>Import Book</Modal.Header>
+        <Modal.Content>
+          <p id="bookInstructions">
+            This imports a book from a library into this Conductor project.


Recommend changing this to "This imports a book from an external source into this Conductor project" for clarity. The current text suggests we are doing more of a copy from LT library to LT library. We may also extend this modal in the future to start import jobs from sources other than PB so this language keeps it open

Alternatively, we could add text like "You can import from the following sources: Pressbooks" and we can add to the list as needed

jakeaturner · 2026-05-07T17:38:57Z

+                control={control}
+                name="pbBookURL"
+                label="Book URL"
+                placeholder="Enter Book URL"


Recommend grabbing a good example pressbooks URL for the placeholder here

jakeaturner · 2026-05-07T18:01:51Z

+router
+  .route("/remixer/:id/project")
+  .get(
+    authAPI.optionalVerifyRequest,


Should switch to authAPI.verifyRequest and authAPI.getUserAttributes for any Remixer endpoints -- we'll plan on everything remixer being behind auth for now

jakeaturner · 2026-05-07T18:02:55Z

You can ignore the rate limiting comments from CodeQL in this file -- these endpoints are rate-limited -- I'm not sure why it's not picking that up

jakeaturner · 2026-05-07T18:06:20Z

+import * as cheerio from "cheerio";
+import { log } from "debug";
+
+export interface RemixerSubPage {


Recommend seeing if we can define this as the "root" interface in server/types/Remixer.ts and then extending the RemixerSubPageState interface in server\models\projectremixer.ts off of it for DRY principle and single source-of-truth

jakeaturner · 2026-05-07T18:10:25Z

+  return trimmedMessage.slice(0, 300);
+};
+
+const buildConductorCookieHeader = (req: Request): string | undefined => {


Let's remove this entirely - the Conductor cookie headers won't mean anything to the libraries and the less we can mess with auth, the better

jakeaturner · 2026-05-07T18:16:45Z

+}
+
+export interface PublishOptions {
+  auth?: { username: string; password: string };


Recommend removing the auth option entirely here - it doesn't look like we're actually making use of it anywhere publishBook is called and it will clean up the code and avoid future confusion

… components with Davis design system

…port and remixer.

…xer API endpoints

… components with Davis design system

aikido-pr-checks · 2026-05-14T15:32:57Z

+    title: 1,
+    _id: 0,
+  };
+  const project = await Project.findOne({ projectID: id }, projection);


NoSQL injection attack possible - critical severity
Query injection attacks are possible if users can pass objects instead of strings to query functions such as findOne.

By injecting query operators attackers can control the behavior of the query, allowing them to bypass access controls and extract unauthorized data. Consider the attack payload ?user_id[$ne]=5: if the user_id query parameter is passed to the query function without validation or casting its type, an attacker can pass {$ne: 5} instead of an integer to the query. {$ne: 5} uses the 'not equal to' operator to access data of other users.

While this vulnerability is known as NoSQL injection, relational databases (mysql, postgres) are also vulnerable to this attack if the query library offers a NoSQL-like API and supports string-typed query operators. Examples include prisma and sequelize versions prior to 4.12.0.

Suggested change

const project = await Project.findOne({ projectID: id }, projection);

const project = await Project.findOne({ projectID: { $eq: id } }, projection);

_{Reply @AikidoSec ignore: [REASON] to ignore this issue.}
_{More info}

feat(project): add project management features including pressbook im…

5293459

…port and remixer.

yghaemi requested a review from jakeaturner May 6, 2026 14:08

aikido-pr-checks Bot reviewed May 6, 2026

View reviewed changes

github-advanced-security AI found potential problems May 6, 2026

View reviewed changes

refactor(remixer): integrate Zod validation for request types in remi…

2da19b8

…xer API endpoints

jakeaturner requested changes May 7, 2026

View reviewed changes

jakeaturner mentioned this pull request May 7, 2026

Remixer v3 and Scraper #782

Closed

feat(remixer): implement ImportWorkbench functionality and enhance UI…

e35b708

… components with Davis design system

yghaemi requested a review from jakeaturner May 12, 2026 18:57

yghaemi added 3 commits May 13, 2026 16:08

feat(project): add project management features including pressbook im…

bfbdd34

…port and remixer.

refactor(remixer): integrate Zod validation for request types in remi…

22898d0

…xer API endpoints

feat(remixer): implement ImportWorkbench functionality and enhance UI…

012dc2f

… components with Davis design system

jakeaturner force-pushed the remixer branch from e35b708 to 012dc2f Compare May 13, 2026 23:08

jakeaturner and others added 2 commits May 13, 2026 16:33

chore(deps): remove unused canvas dependency

3e2b3d4

Merge branch 'remixer' of github.com:LibreTexts/conductor into remixer

45ab004

aikido-pr-checks Bot reviewed May 14, 2026

View reviewed changes

		@@ -0,0 +1,158 @@
		import { Book, MasterCatalogV2Response } from "../../types";

		export type Library = "bio" \| "biz" \| "chem" \| "dev" \| "eng" \| "espanol" \| "geo" \| "human" \| "k12" \| "math" \| "med" \| "phys" \| "socialsci" \| "stats" \| "workforce";

	const project = await Project.findOne({ projectID: id }, projection);
	const project = await Project.findOne({ projectID: { $eq: id } }, projection);

Conversation

yghaemi commented May 6, 2026

Uh oh!

aikido-pr-checks Bot May 6, 2026

Choose a reason for hiding this comment

Uh oh!

github-advanced-security AI left a comment

Choose a reason for hiding this comment

Uh oh!

jakeaturner left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks Bot May 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

aikido-pr-checks Bot May 14, 2026 •

edited

Loading