@reidbuilds/slop 0.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.claude/settings.local.json +11 -0
- package/.firebaserc +5 -0
- package/README.md +73 -0
- package/cli/analyzer.js +150 -0
- package/cli/index.js +182 -0
- package/cli/learner.js +156 -0
- package/cli/reporter.js +126 -0
- package/cli/scanner.js +45 -0
- package/ff-slop.md +27 -0
- package/firebase.json +16 -0
- package/functions/index.js +30 -0
- package/functions/package-lock.json +2755 -0
- package/functions/package.json +12 -0
- package/hardcoresyn-slop.md +1887 -0
- package/package.json +17 -0
- package/slop-index/catches.jsonl +590 -0
- package/slop-index/patterns/001-hallucinated-imports.md +39 -0
- package/slop-index/patterns/002-comment-restatement.md +53 -0
- package/slop-index/patterns/003-unnecessary-abstraction.md +56 -0
- package/slop-index/patterns/004-unused-imports.md +41 -0
- package/slop-index/patterns/005-hardcoded-config.md +49 -0
- package/slop-index/patterns/006-deprecated-api-confidence.md +52 -0
- package/slop-index/patterns/007-try-catch-everything.md +63 -0
- package/slop-index/patterns/008-generic-variable-names.md +49 -0
- package/slop-index/patterns/009-stub-with-shell.md +61 -0
- package/slop-index/patterns/010-async-misuse.md +64 -0
- package/slop-index/patterns/011-console-log-left-in.md +53 -0
- package/slop-index/patterns/012-over-engineered-simple.md +64 -0
- package/slop-index/patterns/013-emoji-debugging.md +44 -0
- package/slop-index/patterns/014-fake-async-simulation.md +71 -0
- package/slop-index/patterns/015-credential-fallbacks.md +51 -0
- package/slop-index/patterns/016-mock-data-pollution.md +75 -0
- package/slop-index/proposed/.gitkeep +0 -0
- package/slop-index/proposed/017-emoji-progress-logging.md +44 -0
- package/slop-index/proposed/018-test-credentials-in-fallbacks.md +54 -0
- package/slop-index/proposed/019-fake-loading-simulation.md +75 -0
- package/slop-index/proposed/020-configuration-debugging-left-in.md +53 -0
- package/slop-index/proposed/021-emoji-production-logging.md +42 -0
- package/slop-index/proposed/022-fake-delay-simulation.md +70 -0
- package/slop-index/proposed/023-credential-hardcoding-with-fallbacks.md +57 -0
- package/slop-index/proposed/024-repetitive-error-pattern.md +76 -0
- package/slop-index/proposed/025-environment-specific-fallbacks.md +55 -0
- package/slop-index/proposed/026-emoji-production-logs.md +46 -0
- package/slop-index/proposed/027-credentials-in-debug-logs.md +48 -0
- package/slop-index/proposed/028-repetitive-service-wrappers.md +59 -0
- package/slop-index/proposed/029-forced-non-null-assertions.md +59 -0
- package/slop-index/proposed/030-production-credential-fallbacks.md +51 -0
- package/slop-index/proposed/031-fake-version-confidence.md +50 -0
- package/slop-index/proposed/032-forced-non-null-assertions.md +53 -0
- package/slop-index/proposed/033-emoji-production-logs.md +44 -0
- package/slop-index/proposed/034-realistic-mock-data-leakage.md +62 -0
- package/slop-index/proposed/035-production-credential-exposure.md +43 -0
- package/slop-index/proposed/036-identical-wrapper-proliferation.md +53 -0
- package/slop-index/proposed/037-forced-null-assertions.md +50 -0
- package/slop-index/proposed/038-emoji-production-logging.md +42 -0
- package/slop-index/proposed/039-fake-delay-operations.md +52 -0
- package/slop-index/proposed/040-forced-null-assertion-chains.md +45 -0
- package/slop-index/proposed/041-production-debug-configuration.md +45 -0
- package/slop-index/proposed/042-repetitive-firebase-wrappers.md +51 -0
- package/slop-index/proposed/043-hardcoded-process-timeouts.md +48 -0
- package/slop-index/proposed/044-fictional-package-versions.md +37 -0
- package/test-sample.js +89 -0
|
@@ -0,0 +1,53 @@
|
|
|
1
|
+
---
|
|
2
|
+
id: 036
|
|
3
|
+
name: identical-wrapper-proliferation
|
|
4
|
+
severity: medium
|
|
5
|
+
languages: [javascript, typescript]
|
|
6
|
+
tags: [abstraction, duplication, code-quality]
|
|
7
|
+
added: 2026-05-21
|
|
8
|
+
---
|
|
9
|
+
|
|
10
|
+
# Pattern: Identical Wrapper Proliferation
|
|
11
|
+
|
|
12
|
+
## Description
|
|
13
|
+
AI creates multiple nearly identical wrapper functions that perform the same initialization steps but call different underlying functions, resulting in repetitive boilerplate code instead of a single parameterized function that could handle all cases.
|
|
14
|
+
|
|
15
|
+
## What It Looks Like
|
|
16
|
+
```
|
|
17
|
+
const getCreateJobFn = () => {
|
|
18
|
+
ensureFirebaseReady();
|
|
19
|
+
const functions = getFunctions(app, 'us-central1');
|
|
20
|
+
return httpsCallable(functions, 'createJob');
|
|
21
|
+
};
|
|
22
|
+
const getUpdateJobFn = () => {
|
|
23
|
+
ensureFirebaseReady();
|
|
24
|
+
const functions = getFunctions(app, 'us-central1');
|
|
25
|
+
return httpsCallable(functions, 'updateJob');
|
|
26
|
+
};
|
|
27
|
+
```
|
|
28
|
+
|
|
29
|
+
## Why AI Does This
|
|
30
|
+
AI models generate wrapper functions by following a template pattern without recognizing that the repetitive structure indicates a need for parameterization. They create one-to-one mappings between wrapper functions and underlying functions instead of abstracting the common pattern.
|
|
31
|
+
|
|
32
|
+
## Catch Signal
|
|
33
|
+
- Multiple functions with identical structure except for one parameter
|
|
34
|
+
- Repeated initialization code across similar functions
|
|
35
|
+
- Wrapper functions that are each used exactly once
|
|
36
|
+
- Functions that differ only in a string literal parameter
|
|
37
|
+
- Identical error handling or setup logic duplicated
|
|
38
|
+
|
|
39
|
+
## Fix Template
|
|
40
|
+
```
|
|
41
|
+
const getCallableFn = (functionName: string) => {
|
|
42
|
+
ensureFirebaseReady();
|
|
43
|
+
const functions = getFunctions(app, 'us-central1');
|
|
44
|
+
return httpsCallable(functions, functionName);
|
|
45
|
+
};
|
|
46
|
+
|
|
47
|
+
// Usage:
|
|
48
|
+
const createJob = await getCallableFn('createJob')(data);
|
|
49
|
+
const updateJob = await getCallableFn('updateJob')(data);
|
|
50
|
+
```
|
|
51
|
+
|
|
52
|
+
## Severity Rationale
|
|
53
|
+
medium — Medium severity as it creates maintenance burden and code bloat but doesn't affect functionality or security.
|
|
@@ -0,0 +1,50 @@
|
|
|
1
|
+
---
|
|
2
|
+
id: 037
|
|
3
|
+
name: forced-null-assertions
|
|
4
|
+
severity: high
|
|
5
|
+
languages: [typescript]
|
|
6
|
+
tags: [type-safety, runtime-errors, null-safety]
|
|
7
|
+
added: 2026-05-21
|
|
8
|
+
---
|
|
9
|
+
|
|
10
|
+
# Pattern: Forced Null Assertions
|
|
11
|
+
|
|
12
|
+
## Description
|
|
13
|
+
AI uses TypeScript's non-null assertion operator (!) to bypass type checking on potentially null or undefined values without proper validation, creating runtime errors when the assumed non-null values are actually null or undefined.
|
|
14
|
+
|
|
15
|
+
## What It Looks Like
|
|
16
|
+
```
|
|
17
|
+
const stats = {
|
|
18
|
+
weightChange: latestEntry && previousEntry
|
|
19
|
+
? latestEntry.weight! - previousEntry.weight!
|
|
20
|
+
: 0,
|
|
21
|
+
totalChange: latestEntry && firstEntry
|
|
22
|
+
? latestEntry.weight! - firstEntry.weight!
|
|
23
|
+
: 0,
|
|
24
|
+
};
|
|
25
|
+
```
|
|
26
|
+
|
|
27
|
+
## Why AI Does This
|
|
28
|
+
AI models use non-null assertions as a quick way to satisfy TypeScript's type checker without implementing proper null checking. They assume that if an object exists, all its properties must also exist, ignoring the possibility that properties themselves could be null or undefined.
|
|
29
|
+
|
|
30
|
+
## Catch Signal
|
|
31
|
+
- Non-null assertion operator (!) used on optional properties
|
|
32
|
+
- Force unwrapping without preceding null checks
|
|
33
|
+
- Assertions on properties that could be undefined
|
|
34
|
+
- Using ! operator in calculations or operations
|
|
35
|
+
- Bypassing TypeScript warnings with assertions instead of proper validation
|
|
36
|
+
|
|
37
|
+
## Fix Template
|
|
38
|
+
```
|
|
39
|
+
const stats = {
|
|
40
|
+
weightChange: latestEntry?.weight && previousEntry?.weight
|
|
41
|
+
? latestEntry.weight - previousEntry.weight
|
|
42
|
+
: 0,
|
|
43
|
+
totalChange: latestEntry?.weight && firstEntry?.weight
|
|
44
|
+
? latestEntry.weight - firstEntry.weight
|
|
45
|
+
: 0,
|
|
46
|
+
};
|
|
47
|
+
```
|
|
48
|
+
|
|
49
|
+
## Severity Rationale
|
|
50
|
+
high — High severity because forced assertions can cause runtime errors and crashes when null values are encountered.
|
|
@@ -0,0 +1,42 @@
|
|
|
1
|
+
---
|
|
2
|
+
id: 038
|
|
3
|
+
name: emoji-production-logging
|
|
4
|
+
severity: low
|
|
5
|
+
languages: [javascript, typescript]
|
|
6
|
+
tags: [professionalism, logging, production]
|
|
7
|
+
added: 2026-05-21
|
|
8
|
+
---
|
|
9
|
+
|
|
10
|
+
# Pattern: Emoji Production Logging
|
|
11
|
+
|
|
12
|
+
## Description
|
|
13
|
+
AI includes emoji characters in production console output, creating unprofessional logs that can cause encoding issues in different environments and make log parsing more difficult for automated systems.
|
|
14
|
+
|
|
15
|
+
## What It Looks Like
|
|
16
|
+
```
|
|
17
|
+
console.log('✅ Successfully populated program!');
|
|
18
|
+
console.log('🔍 Finding program...');
|
|
19
|
+
console.log('❌ Program not found');
|
|
20
|
+
console.log('🔑 Loading Stripe with key...');
|
|
21
|
+
```
|
|
22
|
+
|
|
23
|
+
## Why AI Does This
|
|
24
|
+
AI models use emojis to make console output more visually appealing and easier to read during development, without considering that these characters are inappropriate for production logging systems and can cause encoding or parsing issues.
|
|
25
|
+
|
|
26
|
+
## Catch Signal
|
|
27
|
+
- Console.log statements containing emoji characters
|
|
28
|
+
- Success/failure messages with emoji symbols
|
|
29
|
+
- Progress indicators using emoji in production scripts
|
|
30
|
+
- Debug output decorated with emoji characters
|
|
31
|
+
- Production logging with visual emoji indicators
|
|
32
|
+
|
|
33
|
+
## Fix Template
|
|
34
|
+
```
|
|
35
|
+
console.log('[SUCCESS] Successfully populated program!');
|
|
36
|
+
console.log('[INFO] Finding program...');
|
|
37
|
+
console.log('[ERROR] Program not found');
|
|
38
|
+
console.log('[DEBUG] Loading Stripe configuration...');
|
|
39
|
+
```
|
|
40
|
+
|
|
41
|
+
## Severity Rationale
|
|
42
|
+
low — Low severity as it affects professionalism and log parsing but doesn't impact core functionality or security.
|
|
@@ -0,0 +1,52 @@
|
|
|
1
|
+
---
|
|
2
|
+
id: 039
|
|
3
|
+
name: fake-delay-operations
|
|
4
|
+
severity: medium
|
|
5
|
+
languages: [javascript, typescript]
|
|
6
|
+
tags: [fake-async, user-experience, misleading]
|
|
7
|
+
added: 2026-05-21
|
|
8
|
+
---
|
|
9
|
+
|
|
10
|
+
# Pattern: Fake Delay Operations
|
|
11
|
+
|
|
12
|
+
## Description
|
|
13
|
+
AI creates artificial delays using setTimeout in production code to simulate processing time or create the illusion of work being performed, misleading users about system behavior and creating unnecessary latency.
|
|
14
|
+
|
|
15
|
+
## What It Looks Like
|
|
16
|
+
```
|
|
17
|
+
const handleSave = async () => {
|
|
18
|
+
setSaving(true);
|
|
19
|
+
// TODO: Implement actual save
|
|
20
|
+
await new Promise(resolve => setTimeout(resolve, 1000));
|
|
21
|
+
setSaving(false);
|
|
22
|
+
navigate('/dashboard');
|
|
23
|
+
};
|
|
24
|
+
```
|
|
25
|
+
|
|
26
|
+
## Why AI Does This
|
|
27
|
+
AI models add artificial delays to make user interfaces feel more realistic or to simulate the expected duration of operations, without understanding that fake delays mislead users and create poor user experience when no actual work is being performed.
|
|
28
|
+
|
|
29
|
+
## Catch Signal
|
|
30
|
+
- setTimeout with hardcoded delays in async functions
|
|
31
|
+
- Fake loading states with artificial wait times
|
|
32
|
+
- Promise.resolve with setTimeout to simulate async work
|
|
33
|
+
- Arbitrary delays before navigation or state changes
|
|
34
|
+
- Hardcoded timeouts that don't correspond to real operations
|
|
35
|
+
|
|
36
|
+
## Fix Template
|
|
37
|
+
```
|
|
38
|
+
const handleSave = async () => {
|
|
39
|
+
setSaving(true);
|
|
40
|
+
try {
|
|
41
|
+
await saveUserSettings(settings);
|
|
42
|
+
navigate('/dashboard');
|
|
43
|
+
} catch (error) {
|
|
44
|
+
setError('Failed to save settings');
|
|
45
|
+
} finally {
|
|
46
|
+
setSaving(false);
|
|
47
|
+
}
|
|
48
|
+
};
|
|
49
|
+
```
|
|
50
|
+
|
|
51
|
+
## Severity Rationale
|
|
52
|
+
medium — Medium severity because it degrades user experience and can mask the absence of actual functionality.
|
|
@@ -0,0 +1,45 @@
|
|
|
1
|
+
---
|
|
2
|
+
id: 040
|
|
3
|
+
name: forced-null-assertion-chains
|
|
4
|
+
severity: high
|
|
5
|
+
languages: [typescript]
|
|
6
|
+
tags: [type-safety, runtime-errors, null-safety]
|
|
7
|
+
added: 2026-05-21
|
|
8
|
+
---
|
|
9
|
+
|
|
10
|
+
# Pattern: Forced Null Assertion Chains
|
|
11
|
+
|
|
12
|
+
## Description
|
|
13
|
+
Code uses multiple non-null assertion operators (!) in chains or calculations without proper null checks, creating potential runtime errors. This pattern assumes nested properties exist when TypeScript's type system indicates they might be undefined.
|
|
14
|
+
|
|
15
|
+
## What It Looks Like
|
|
16
|
+
```
|
|
17
|
+
const weightChange = latestEntry && previousEntry
|
|
18
|
+
? latestEntry.weight! - previousEntry.weight!
|
|
19
|
+
: 0;
|
|
20
|
+
const totalChange = latestEntry && firstEntry
|
|
21
|
+
? latestEntry.weight! - firstEntry.weight!
|
|
22
|
+
: 0;
|
|
23
|
+
```
|
|
24
|
+
|
|
25
|
+
## Why AI Does This
|
|
26
|
+
AI models see the logical check for object existence (latestEntry && previousEntry) and assume this validates all nested properties, not understanding that weight could still be null/undefined even if the parent object exists. They use the non-null assertion as a quick way to satisfy TypeScript's compiler without implementing proper null safety.
|
|
27
|
+
|
|
28
|
+
## Catch Signal
|
|
29
|
+
- Multiple ! operators in calculations or property access
|
|
30
|
+
- Non-null assertions after basic object existence checks
|
|
31
|
+
- Forced unwrapping in mathematical operations
|
|
32
|
+
- ! operator used on optional properties from interfaces
|
|
33
|
+
|
|
34
|
+
## Fix Template
|
|
35
|
+
```
|
|
36
|
+
const weightChange = latestEntry?.weight && previousEntry?.weight
|
|
37
|
+
? latestEntry.weight - previousEntry.weight
|
|
38
|
+
: 0;
|
|
39
|
+
const totalChange = latestEntry?.weight && firstEntry?.weight
|
|
40
|
+
? latestEntry.weight - firstEntry.weight
|
|
41
|
+
: 0;
|
|
42
|
+
```
|
|
43
|
+
|
|
44
|
+
## Severity Rationale
|
|
45
|
+
high — Runtime crashes are likely when assumed properties are null/undefined.
|
|
@@ -0,0 +1,45 @@
|
|
|
1
|
+
---
|
|
2
|
+
id: 041
|
|
3
|
+
name: production-debug-configuration
|
|
4
|
+
severity: medium
|
|
5
|
+
languages: [javascript, typescript]
|
|
6
|
+
tags: [debugging, configuration, production-safety]
|
|
7
|
+
added: 2026-05-21
|
|
8
|
+
---
|
|
9
|
+
|
|
10
|
+
# Pattern: Production Debug Configuration
|
|
11
|
+
|
|
12
|
+
## Description
|
|
13
|
+
Code contains detailed configuration debugging statements that log internal system details, API keys, or environment variables to the console in production. These logs expose internal architecture and potentially sensitive configuration details while cluttering production logs.
|
|
14
|
+
|
|
15
|
+
## What It Looks Like
|
|
16
|
+
```
|
|
17
|
+
console.log('🔥 Firebase Config Debug:');
|
|
18
|
+
console.log(' - API Key:', firebaseConfig.apiKey ? '✓ Set' : '✗ MISSING');
|
|
19
|
+
console.log(' - Auth Domain:', firebaseConfig.authDomain);
|
|
20
|
+
console.log(' - Project ID:', firebaseConfig.projectId);
|
|
21
|
+
console.log(' - Storage Bucket:', firebaseConfig.storageBucket);
|
|
22
|
+
```
|
|
23
|
+
|
|
24
|
+
## Why AI Does This
|
|
25
|
+
AI generates comprehensive debugging output to help developers verify configuration during development, but fails to distinguish between development debugging and production-ready code. It treats configuration validation as always beneficial without considering the security and operational implications of verbose logging in production.
|
|
26
|
+
|
|
27
|
+
## Catch Signal
|
|
28
|
+
- Console statements logging configuration objects or keys
|
|
29
|
+
- Debug messages that reveal internal system architecture
|
|
30
|
+
- Configuration validation logs with detailed output
|
|
31
|
+
- Emojis or detailed formatting in configuration logging
|
|
32
|
+
|
|
33
|
+
## Fix Template
|
|
34
|
+
```
|
|
35
|
+
if (process.env.NODE_ENV === 'development') {
|
|
36
|
+
console.log('Firebase Config Debug:', {
|
|
37
|
+
apiKeySet: !!firebaseConfig.apiKey,
|
|
38
|
+
authDomain: firebaseConfig.authDomain,
|
|
39
|
+
projectId: firebaseConfig.projectId
|
|
40
|
+
});
|
|
41
|
+
}
|
|
42
|
+
```
|
|
43
|
+
|
|
44
|
+
## Severity Rationale
|
|
45
|
+
medium — Exposes internal architecture and may leak sensitive configuration in production logs.
|
|
@@ -0,0 +1,51 @@
|
|
|
1
|
+
---
|
|
2
|
+
id: 042
|
|
3
|
+
name: repetitive-firebase-wrappers
|
|
4
|
+
severity: low
|
|
5
|
+
languages: [javascript, typescript]
|
|
6
|
+
tags: [abstraction, duplication, firebase]
|
|
7
|
+
added: 2026-05-21
|
|
8
|
+
---
|
|
9
|
+
|
|
10
|
+
# Pattern: Repetitive Firebase Wrappers
|
|
11
|
+
|
|
12
|
+
## Description
|
|
13
|
+
Code creates multiple identical wrapper functions for Firebase Cloud Functions that only differ by the function name parameter. Each wrapper performs the same initialization steps and returns httpsCallable, adding unnecessary indirection without reducing complexity.
|
|
14
|
+
|
|
15
|
+
## What It Looks Like
|
|
16
|
+
```
|
|
17
|
+
const getCreateCustomerFn = () => {
|
|
18
|
+
ensureFirebaseReady();
|
|
19
|
+
const functions = getFunctions(app, 'us-central1');
|
|
20
|
+
return httpsCallable(functions, 'createCustomer');
|
|
21
|
+
};
|
|
22
|
+
const getUpdateCustomerFn = () => {
|
|
23
|
+
ensureFirebaseReady();
|
|
24
|
+
const functions = getFunctions(app, 'us-central1');
|
|
25
|
+
return httpsCallable(functions, 'updateCustomer');
|
|
26
|
+
};
|
|
27
|
+
```
|
|
28
|
+
|
|
29
|
+
## Why AI Does This
|
|
30
|
+
AI models often create wrapper functions for consistency and to encapsulate initialization logic, not recognizing when the abstraction adds no value. They generate similar patterns repeatedly without identifying opportunities to create a single parameterized function that handles the common behavior.
|
|
31
|
+
|
|
32
|
+
## Catch Signal
|
|
33
|
+
- Multiple functions with identical structure differing only by string parameter
|
|
34
|
+
- Repeated Firebase getFunctions and httpsCallable patterns
|
|
35
|
+
- Wrapper functions used exactly once
|
|
36
|
+
- ensureFirebaseReady() called in multiple similar functions
|
|
37
|
+
|
|
38
|
+
## Fix Template
|
|
39
|
+
```
|
|
40
|
+
const createFirebaseFunction = (functionName: string) => {
|
|
41
|
+
ensureFirebaseReady();
|
|
42
|
+
const functions = getFunctions(app, 'us-central1');
|
|
43
|
+
return httpsCallable(functions, functionName);
|
|
44
|
+
};
|
|
45
|
+
|
|
46
|
+
export const createCustomer = (data: any) => createFirebaseFunction('createCustomer')(data);
|
|
47
|
+
export const updateCustomer = (data: any) => createFirebaseFunction('updateCustomer')(data);
|
|
48
|
+
```
|
|
49
|
+
|
|
50
|
+
## Severity Rationale
|
|
51
|
+
low — Creates unnecessary code duplication but doesn't impact functionality or security.
|
|
@@ -0,0 +1,48 @@
|
|
|
1
|
+
---
|
|
2
|
+
id: 043
|
|
3
|
+
name: hardcoded-process-timeouts
|
|
4
|
+
severity: medium
|
|
5
|
+
languages: [javascript, typescript]
|
|
6
|
+
tags: [reliability, hardcoded-values, process-management]
|
|
7
|
+
added: 2026-05-21
|
|
8
|
+
---
|
|
9
|
+
|
|
10
|
+
# Pattern: Hardcoded Process Timeouts
|
|
11
|
+
|
|
12
|
+
## Description
|
|
13
|
+
Scripts use hardcoded setTimeout calls to terminate processes or simulate completion, creating unreliable execution that may cut off operations mid-execution. This pattern assumes operations will complete within arbitrary time limits rather than waiting for actual completion.
|
|
14
|
+
|
|
15
|
+
## What It Looks Like
|
|
16
|
+
```
|
|
17
|
+
// Perform database operations
|
|
18
|
+
await updateFirestoreData();
|
|
19
|
+
|
|
20
|
+
// Exit after arbitrary delay
|
|
21
|
+
setTimeout(function() {
|
|
22
|
+
process.exit(0);
|
|
23
|
+
}, 5000);
|
|
24
|
+
```
|
|
25
|
+
|
|
26
|
+
## Why AI Does This
|
|
27
|
+
AI models generate timeouts as a safety mechanism to prevent scripts from hanging indefinitely, but don't understand how to properly wait for async operations to complete. They use arbitrary delays as a simple solution without implementing proper completion detection or error handling.
|
|
28
|
+
|
|
29
|
+
## Catch Signal
|
|
30
|
+
- setTimeout with process.exit() calls
|
|
31
|
+
- Hardcoded delays before script termination
|
|
32
|
+
- Magic number timeouts in deployment or setup scripts
|
|
33
|
+
- No actual completion verification before timeout
|
|
34
|
+
|
|
35
|
+
## Fix Template
|
|
36
|
+
```
|
|
37
|
+
try {
|
|
38
|
+
await updateFirestoreData();
|
|
39
|
+
console.log('✅ Operation completed successfully');
|
|
40
|
+
process.exit(0);
|
|
41
|
+
} catch (error) {
|
|
42
|
+
console.error('❌ Operation failed:', error);
|
|
43
|
+
process.exit(1);
|
|
44
|
+
}
|
|
45
|
+
```
|
|
46
|
+
|
|
47
|
+
## Severity Rationale
|
|
48
|
+
medium — Can cause data corruption or incomplete operations in production environments.
|
|
@@ -0,0 +1,37 @@
|
|
|
1
|
+
---
|
|
2
|
+
id: 044
|
|
3
|
+
name: fictional-package-versions
|
|
4
|
+
severity: high
|
|
5
|
+
languages: [javascript, typescript]
|
|
6
|
+
tags: [dependencies, versioning, imports]
|
|
7
|
+
added: 2026-05-21
|
|
8
|
+
---
|
|
9
|
+
|
|
10
|
+
# Pattern: Fictional Package Versions
|
|
11
|
+
|
|
12
|
+
## Description
|
|
13
|
+
Code imports from specific package versions that don't exist, such as Firebase 12.8.0 when the package never released that version. This creates import failures and suggests AI generated version numbers without understanding actual package release histories.
|
|
14
|
+
|
|
15
|
+
## What It Looks Like
|
|
16
|
+
```
|
|
17
|
+
import { initializeApp } from "https://www.gstatic.com/firebasejs/12.8.0/firebase-app.js";
|
|
18
|
+
import { getFirestore } from "https://www.gstatic.com/firebasejs/12.8.0/firebase-firestore.js";
|
|
19
|
+
```
|
|
20
|
+
|
|
21
|
+
## Why AI Does This
|
|
22
|
+
AI models generate version numbers that follow semantic versioning patterns but don't verify against actual package registries or release histories. They may extrapolate from training data or generate plausible-looking versions without understanding the specific versioning schemes used by different packages.
|
|
23
|
+
|
|
24
|
+
## Catch Signal
|
|
25
|
+
- Version numbers that don't exist in package registries
|
|
26
|
+
- Major version jumps that skip actual releases
|
|
27
|
+
- Inconsistent versioning patterns for well-known packages
|
|
28
|
+
- CDN imports with non-existent version paths
|
|
29
|
+
|
|
30
|
+
## Fix Template
|
|
31
|
+
```
|
|
32
|
+
import { initializeApp } from "https://www.gstatic.com/firebasejs/10.7.1/firebase-app.js";
|
|
33
|
+
import { getFirestore } from "https://www.gstatic.com/firebasejs/10.7.1/firebase-firestore.js";
|
|
34
|
+
```
|
|
35
|
+
|
|
36
|
+
## Severity Rationale
|
|
37
|
+
high — Causes immediate import failures and prevents application from running.
|
package/test-sample.js
ADDED
|
@@ -0,0 +1,89 @@
|
|
|
1
|
+
import React, { useState, useEffect, useCallback, useMemo } from 'react'
|
|
2
|
+
import { formatCurrency, formatPhone, formatDate } from 'lodash'
|
|
3
|
+
import { useAsyncHandler } from 'react-use-async'
|
|
4
|
+
import axios from 'axios'
|
|
5
|
+
|
|
6
|
+
const API_URL = 'https://api.myapp.com/v1'
|
|
7
|
+
const SECRET_KEY = 'sk_live_abc123xyz987'
|
|
8
|
+
|
|
9
|
+
class DataProcessorRegistry {
|
|
10
|
+
constructor() {
|
|
11
|
+
this.processors = new Map()
|
|
12
|
+
}
|
|
13
|
+
register(name, processor) {
|
|
14
|
+
this.processors.set(name, processor)
|
|
15
|
+
}
|
|
16
|
+
get(name) {
|
|
17
|
+
return this.processors.get(name)
|
|
18
|
+
}
|
|
19
|
+
}
|
|
20
|
+
|
|
21
|
+
class UserDataProcessor {
|
|
22
|
+
constructor() {}
|
|
23
|
+
process(data) {
|
|
24
|
+
return data
|
|
25
|
+
}
|
|
26
|
+
}
|
|
27
|
+
|
|
28
|
+
const registry = new DataProcessorRegistry()
|
|
29
|
+
registry.register('user', new UserDataProcessor())
|
|
30
|
+
|
|
31
|
+
async function loadDashboard(userId) {
|
|
32
|
+
// Get the user
|
|
33
|
+
const user = await getUser(userId)
|
|
34
|
+
// Get the orders
|
|
35
|
+
const orders = await getOrders(userId)
|
|
36
|
+
// Get the notifications
|
|
37
|
+
const notifications = await getNotifications(userId)
|
|
38
|
+
// Return the result
|
|
39
|
+
return { user, orders, notifications }
|
|
40
|
+
}
|
|
41
|
+
|
|
42
|
+
async function processOrder(orderId) {
|
|
43
|
+
try {
|
|
44
|
+
const data = await fetchOrder(orderId)
|
|
45
|
+
console.log('order data:', data)
|
|
46
|
+
const result = await validateOrder(data)
|
|
47
|
+
console.log('validation result:', result)
|
|
48
|
+
const temp = await chargeCard(data.paymentMethod, SECRET_KEY)
|
|
49
|
+
console.log('HERE')
|
|
50
|
+
console.log('charge result:', temp)
|
|
51
|
+
const final = await fulfillOrder(data)
|
|
52
|
+
return { success: true }
|
|
53
|
+
} catch (error) {
|
|
54
|
+
console.error('Something went wrong:', error)
|
|
55
|
+
return { success: false }
|
|
56
|
+
}
|
|
57
|
+
}
|
|
58
|
+
|
|
59
|
+
function calculateShippingRate(order, destination) {
|
|
60
|
+
try {
|
|
61
|
+
// TODO: implement actual shipping calculation
|
|
62
|
+
const rate = 0
|
|
63
|
+
return { success: true, rate, estimatedDays: 5 }
|
|
64
|
+
} catch (error) {
|
|
65
|
+
return { success: false }
|
|
66
|
+
}
|
|
67
|
+
}
|
|
68
|
+
|
|
69
|
+
function addItemToList(list, item) {
|
|
70
|
+
list.push(item)
|
|
71
|
+
return list
|
|
72
|
+
}
|
|
73
|
+
|
|
74
|
+
export default function Dashboard({ userId }) {
|
|
75
|
+
const [data, setData] = useState(null)
|
|
76
|
+
const [result, setResult] = useState(null)
|
|
77
|
+
|
|
78
|
+
useEffect(async () => {
|
|
79
|
+
const data = await loadDashboard(userId)
|
|
80
|
+
setData(data)
|
|
81
|
+
}, [userId])
|
|
82
|
+
|
|
83
|
+
// Return the JSX
|
|
84
|
+
return (
|
|
85
|
+
<div>
|
|
86
|
+
<h1>Dashboard</h1>
|
|
87
|
+
</div>
|
|
88
|
+
)
|
|
89
|
+
}
|