Remote commands API update#33
Conversation
…d parameter in RemoteCommand class to commandData for better readability. Updated references to payload in CommandEvent class. Commented out set viewController and set attributes methods in ElementTreeEntry class.
WalkthroughA new Changes
Sequence Diagram(s)sequenceDiagram
participant JSON
participant CommandEvent
participant RemoteCommand
JSON->>CommandEvent: fromJson(json)
CommandEvent->>RemoteCommand: Construct with commandData = json["commandData"] ?? {}
RemoteCommand-->>CommandEvent: Instance with commandData field
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
📜 Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Pro
📒 Files selected for processing (4)
.fvmrc(1 hunks)lib/src/action_api/command.dart(1 hunks)lib/src/action_api/event.dart(1 hunks)lib/src/ui/tree_element.dart(1 hunks)
🔇 Additional comments (3)
lib/src/action_api/command.dart (2)
7-7: LGTM: Field rename improves clarity.The rename from
payloadtocommandDatamakes the purpose more explicit and improves code readability.
12-12: All RemoteCommand usages updated tocommandDataConfirmed that there are no remaining instances of the old
payloadparameter inRemoteCommand:
- lib/src/action_api/command.dart – constructor now declares
required this.commandData- lib/src/action_api/event.dart –
CommandEvent.fromJsoninvokesRemoteCommand(..., commandData: …)No further changes needed.
lib/src/action_api/event.dart (1)
201-201: LGTM: JSON parsing properly updated to match API change.The update from
"payload"to"commandData"correctly aligns with the field rename in theRemoteCommandclass, maintaining consistency across the command API.
| { | ||
| "flutter": "3.24.3", | ||
| "updateVscodeSettings": true, | ||
| "updateGitIgnore": true, | ||
| "runPubGetOnSdkChanges": true | ||
| } No newline at end of file |
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
Verify Flutter version validity and security status.
Ensure that Flutter 3.24.3 is a valid, stable version and check for any known security vulnerabilities.
🌐 Web query:
Is Flutter 3.24.3 a valid release version? Are there any known security vulnerabilities in Flutter 3.24.3?
💡 Result:
Flutter 3.24.3 is a valid release version. Community discussions and GitHub issues confirm that developers have used Flutter 3.24.3 as a stable version as recently as June 2025[7]. It is referenced in multiple community channels and bug reports as a deployed, official Flutter release[6][7][8].
Security vulnerabilities:
There is a known issue with Flutter 3.24.3 related to Intent Redirection on Android, which has been flagged as a security vulnerability. Specifically, an app built with Flutter SDK 3.24.3 was rejected by the Google Play Store due to this security issue, which can potentially expose user information or damage a device. The vulnerability is identified as intent redirection in the app's code, violating Google’s Device and Network Abuse policy[2].
We found that your app contains security vulnerabilities, which can expose user information or damage a user’s device. This is a violation of Device and Network Abuse policy. Specifically, your app(s) are vulnerable to Intent Redirection[2].
No official Flutter release notes explicitly detail this security flaw in version 3.24.3; however, user reports and Play Store feedback suggest it is a significant issue for apps targeting Android[2].
Summary Table
| Version | Status | Known Security Issues |
|---|---|---|
| 3.24.3 | Valid/stable | Yes: Intent Redirection (Android)[2] |
| 3.27.x and above | Stable | Not flagged for same issue (as of date) |
For the latest and most secure experience, consider upgrading to a newer Flutter version, as more recent releases like 3.27 and 3.32 are available and may address or avoid this vulnerability[1][4][7]. Always review the release notes and changelogs for security updates relative to your target platforms.
Citations:
- 1: https://docs.flutter.dev/release/archive-whats-new
- 2: “Your app(s) are vulnerable to Intent Redirection” flutter/flutter#155493
- 3: https://docs.flutter.dev/release/breaking-changes
- 4: https://docs.flutter.dev/release/release-notes
- 5: https://community.flutterflow.io/discussions/post/apk-crash-after-3-24-2-flutter-update-6iWn5tXbN1gpYvA
- 6: Flutter 3.24 build apk issue aws-amplify/amplify-flutter#5542
- 7: https://forum.itsallwidgets.com/t/flutter-stable-version/3521
- 8: After upgrade to Flutter sdk 3.24.3, arise the error while build android apk or run on device flutter/flutter#155646
- 9: https://docs.flutter.dev/release/release-notes/release-notes-3.22.0
- 10: https://docs.flutter.dev/release/release-notes/release-notes-3.24.0
Upgrade Flutter version to mitigate known security issue
Flutter 3.24.3 is a valid, stable release but is affected by a known Android Intent Redirection vulnerability that can cause Google Play Store rejections. Please bump the SDK to a newer stable version (e.g. 3.27.0 or above) that is not flagged for this issue.
• File needing update:
- .fvmrc (line 2)
• Proposed change:
{
- "flutter": "3.24.3",
+ "flutter": "3.27.0", // or later stable release
"updateVscodeSettings": true,
"updateGitIgnore": true,
"runPubGetOnSdkChanges": true
}Committable suggestion skipped: line range outside the PR's diff.
🤖 Prompt for AI Agents
In the .fvmrc file at line 2, the Flutter SDK version is set to 3.24.3, which
has a known security vulnerability. Update the Flutter version string to a newer
stable release such as 3.27.0 or above to mitigate the Android Intent
Redirection issue and avoid Google Play Store rejections.
| // set viewController(UIElementController viewController) { | ||
| // this.viewController = viewController; | ||
| // } | ||
|
|
||
| // set attributes(ViewAttribute attributes) { | ||
| // this.attributes = attributes; | ||
| // } |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Remove commented-out code or provide clear justification.
The commented-out setter methods have several issues:
- They contain incorrect syntax - trying to assign
this.viewController = viewControllerwhereviewControlleris an abstract property - Commented code in production should be avoided unless there's a specific reason for future reference
If these setters are planned for future implementation, consider creating a TODO comment or tracking issue instead.
- // set viewController(UIElementController viewController) {
- // this.viewController = viewController;
- // }
-
- // set attributes(ViewAttribute attributes) {
- // this.attributes = attributes;
- // }📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| // set viewController(UIElementController viewController) { | |
| // this.viewController = viewController; | |
| // } | |
| // set attributes(ViewAttribute attributes) { | |
| // this.attributes = attributes; | |
| // } |
🤖 Prompt for AI Agents
In lib/src/ui/tree_element.dart around lines 41 to 47, remove the commented-out
setter methods for viewController and attributes because they contain incorrect
syntax and commented code should not remain in production. If these setters are
intended for future use, replace the commented code with a clear TODO comment or
reference a tracking issue instead.
* breaking: DuitDataSource (#32) * experiment - removing attribute support * wip * wip * wip * refacror ViewAttributes class * Added tests * wip * Added early exit from methods * Added new functions for handling JSON parsing results, improved default result return logic, and added table mapping for BlendMode and FloatingActionButtonLocation. * docs * add tests * Added tests * Removed static mapping tables for Clip, TextAlign, TextOverflow and TextWidthBasis in the DuitDataSource class. * Added new methods for JSON processing, including support for textDecorationStyle, fontWeight, fontStyle and other attributes. Improved logic for returning default values and added corresponding tests. * Added tests * Removed unused methods and added new functions to handle theme rules and image filters. Updated tests to check new features and JSON processing logic. * Upd .gitignore * wip * Upd tests, added Tween parser * Removed ventilation methods, added new functions for widget handling. Updated tests to check new features and JSON handling logic. * Refactored functions for creating InputBorder and ShapeBorder from a map, as well as corresponding lookup tables. Simplified logic for selecting the border type. * Added docs * upd actions config * wip * wip * Update test/theme_test.dart Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * clean dead code * fix * Update lib/src/view_attributes/lookup.dart Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Added export of Command.dart file to action_api and removed it from animation_api. Updated data references in DuitDataSource class to use new "stretchModes" key. Fixes to tests to match changes in step data. --------- Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Remote commands API update (#33) * breaking: Themes refactoring (#34) * Registry API update: Added new RefWithTarget class, changed component initialization and registration functions, removed unused files, and improved export structure. Updated tests and removed deprecated topic tokens. * upd workflow * breaking: Reworking the widget model API and simplifying registration of custom widgets (#35) * Removed unused factory_record.dart file and updated component registration logic in DuitRegistry class, removed references to model factories. Updated factory getter methods to match new changes. * Small fix for tweens parser * rm unused API part * Update lib/src/registry_api/registry.dart Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * review fixes * fix --------- Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Improve lootup tables for enums (#36) * Flutter types json encoding (#37) * Added encoding functions for: Duration, Size, EdgeInsets, TextStyle, Color, LinearGradient, BoxShadow, Offset, BoxDecoration, BorderRadius, Border, BorderSide, InputBorder, InputDecoration, VisualDensity, ScrollPhysics, ShapeBorder * wip * Added tests * Apply suggestions from code review Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Fix tests * Added docs * dart format --------- Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * feat: action debounce and throttle configuration (#38) * Added execution options for actions: added ExecutionOptions class with throttle and debounce modifiers, updated ServerAction classes and their descendants to support the new options. Updated parsing methods and added corresponding lookup tables for execution modifiers. * - Added test - Refactor DuitDataSource methods with one-line return and fail-fast approach at lookup tables work * fix Color parsers behavior * refactoring: improved color handling in _colorFromList function Changed the typification function of the _colorFromList parameter from List<num> to List, added preprocessing of color data to ensure correct conversion. Updated the corresponding calls in the JSON parsing and processing methods in the DuitDataSource class. * feat: Fragments registration in DuitRegistry (#39) Added a new static method registerFragment for registering fragments by key and a method getFragment for receiving a fragment by key with logging in case of absence. Also added an internal registry of fragments _fragmentRegistry. * Component system refactor (#40) * Components refactoring via JSON patching instead of Map mutation * Added tests for json patching and components patches generation * Review fixes * Upd lookup table for Curves * Remover legacy API references * feat: DuitDataSource methods extension (#41) * Extend parser for BorderRadius type, added Radius type parsing, upd tests * fix tests * Added new Size parsing behavior * wip * feat: Custom json reviver (#42) * Refactor env variables, refactor analysis issues in test files, added FlutterPropertyKeys class * wip * wip * wip * Fixed analysis issues * wip * Fixed getActionDependencies and childObjects methods * Upd env variables keys * Code review fixes * Fix test * Upd post-merge workflow
1 participant
Summary by CodeRabbit
Chores
Refactor
Style