fix(contributors): stop fabricating profile links from unverified commit metadata #5506
1 changed file+25−0
Modifiedsrc/routes/web.tsx+25−0View fileUnifiedSplit
@@ -3256,7 +3256,27 @@ web.get("/:owner/:repo", async (c) => {
32563256 createdAt: null as Date | null,
32573257 repoId: null as string | null,
32583258 repoOwnerId: null as string | null,
3259 forkedFrom: null as string | null,
32593260 };
3261 // Fork provenance — a fork must never render as if it were the
3262 // original. Only revealed when the parent repo is public, so a fork
3263 // of a private repo doesn't leak the parent's existence.
3264 let forkedFrom: string | null = null;
3265 if (repoRow.forkedFromId) {
3266 const [parent] = await db
3267 .select({
3268 name: repositories.name,
3269 isPrivate: repositories.isPrivate,
3270 ownerName: users.username,
3271 })
3272 .from(repositories)
3273 .innerJoin(users, eq(users.id, repositories.ownerId))
3274 .where(eq(repositories.id, repoRow.forkedFromId))
3275 .limit(1);
3276 if (parent && !parent.isPrivate) {
3277 forkedFrom = `${parent.ownerName}/${parent.name}`;
3278 }
3279 }
32603280 let starred = false;
32613281 if (user) {
32623282 const [star] = await db
@@ -3282,6 +3302,7 @@ web.get("/:owner/:repo", async (c) => {
32823302 createdAt: (repoRow.createdAt as Date | null) ?? null,
32833303 repoId: repoRow.id as string,
32843304 repoOwnerId: repoRow.ownerId as string,
3305 forkedFrom,
32853306 };
32863307 } catch {
32873308 return {
@@ -3295,6 +3316,7 @@ web.get("/:owner/:repo", async (c) => {
32953316 createdAt: null as Date | null,
32963317 repoId: null as string | null,
32973318 repoOwnerId: null as string | null,
3319 forkedFrom: null as string | null,
32983320 };
32993321 }
33003322 })(),
@@ -3320,6 +3342,7 @@ web.get("/:owner/:repo", async (c) => {
33203342 createdAt,
33213343 repoId,
33223344 repoOwnerId,
3345 forkedFrom,
33233346 } = starInfo;
33243347
33253348 // Health score badge — fire-and-forget, best-effort. If the DB call fails
@@ -4030,6 +4053,7 @@ web.get("/:owner/:repo", async (c) => {
40304053 archived={archived}
40314054 isTemplate={isTemplate}
40324055 recentPush={recentPush}
4056 forkedFrom={forkedFrom}
40334057 />
40344058 {healthScore && (() => {
40354059 const gradeLabel: Record<string, string> = {
@@ -4167,6 +4191,7 @@ web.get("/:owner/:repo", async (c) => {
41674191 archived={archived}
41684192 isTemplate={isTemplate}
41694193 recentPush={recentPush}
4194 forkedFrom={forkedFrom}
41704195 />
41714196 {healthScore && (() => {
41724197 const gradeLabel: Record<string, string> = {
41734198
c comment · e edit title · m merge · a approve · r request changes · ? shortcuts