Skip to content
Draft
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
57 changes: 57 additions & 0 deletions packages/registry/public/r/registry.json
Original file line number Diff line number Diff line change
Expand Up @@ -649,6 +649,63 @@
}
],
"type": "registry:block"
},
{
"name": "sign-up-next",
"dependencies": [
"@aura-stack/next"
],
"registryDependencies": [
"input",
"button",
"card",
"field"
],
"files": [
{
"path": "src/registry/new-york/blocks/next/sign-up/sign-up.tsx",
"type": "registry:block"
}
],
"type": "registry:block"
},
{
"name": "sign-up-react",
"dependencies": [
"@aura-stack/react"
],
"registryDependencies": [
"input",
"button",
"card",
"field"
],
"files": [
{
"path": "src/registry/new-york/blocks/react/sign-up/sign-up.tsx",
"type": "registry:block"
}
],
"type": "registry:block"
},
{
"name": "sign-up-react-router",
"dependencies": [
"@aura-stack/react-router"
],
"registryDependencies": [
"input",
"button",
"card",
"field"
],
"files": [
{
"path": "src/registry/new-york/blocks/react-router/sign-up/sign-up.tsx",
"type": "registry:block"
}
],
"type": "registry:block"
}
]
}
36 changes: 36 additions & 0 deletions packages/registry/registry.json
Original file line number Diff line number Diff line change
Expand Up @@ -297,6 +297,42 @@
"type": "registry:block"
}
]
},
{
"name": "sign-up-next",
"type": "registry:block",
"dependencies": ["@aura-stack/next"],
"registryDependencies": ["input", "button", "card", "field"],
"files": [
{
"path": "src/registry/new-york/blocks/next/sign-up/sign-up.tsx",
"type": "registry:block"
}
]
},
{
"name": "sign-up-react",
"type": "registry:block",
"dependencies": ["@aura-stack/react"],
"registryDependencies": ["input", "button", "card", "field"],
"files": [
{
"path": "src/registry/new-york/blocks/react/sign-up/sign-up.tsx",
"type": "registry:block"
}
]
},
{
"name": "sign-up-react-router",
"type": "registry:block",
"dependencies": ["@aura-stack/react-router"],
"registryDependencies": ["input", "button", "card", "field"],
"files": [
{
"path": "src/registry/new-york/blocks/react-router/sign-up/sign-up.tsx",
"type": "registry:block"
}
]
}
]
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,101 @@
"use client"

import Link from "next/link"
import { Input } from "@/components/ui/input"
import { Button } from "@/components/ui/button"
import { Field, FieldDescription, FieldGroup, FieldLabel } from "@/components/ui/field"
import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card"

export const SignUp = () => {
return (
<Card className="max-w-lg px-6 py-8 sm:p-8 relative gap-6">
<CardHeader className="text-center gap-6 p-0">
<div className="flex flex-col gap-1">
<CardTitle className="text-2xl font-medium text-card-foreground">Welcome to Aura Stack</CardTitle>
<CardDescription className="text-sm text-muted-foreground font-normal">
Fill in the form below to create your account
</CardDescription>
</div>
</CardHeader>
<CardContent className="p-0">
<form>

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Prevent password values from being sent via URL on submit.

Line 21 uses a bare <form>, which defaults to GET; submitting this form can expose password and confirmPassword in query params.

🔧 Suggested patch
-                <form>
+                <form method="post" onSubmit={(event) => event.preventDefault()}>
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
<form>
<form method="post" onSubmit={(event) => event.preventDefault()}>
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/registry/src/registry/new-york/blocks/next/sign-up/sign-up.tsx` at
line 21, The form currently uses the default GET submission which can leak
password and confirmPassword in the URL; update the <form> in the SignUp
component to use method="post" and remove any action that would cause a
full-page GET, or replace with a controlled onSubmit handler (e.g., handleSubmit
in the sign-up component) that calls event.preventDefault() and submits
credentials via a secure POST (fetch or form POST) so password fields are never
sent as query parameters; ensure the changed <form> element and any added
handleSubmit are used in the sign-up.tsx JSX.

<FieldGroup className="gap-6">
<div className="flex flex-col gap-4">
<Field className="gap-1.5">
<FieldLabel htmlFor="username" className="text-sm">
Username
</FieldLabel>
<Input
id="username"
type="text"
name="username"
required
placeholder="johndoe"
aria-label="Username"
className="dark:bg-background h-9 shadow-xs"
/>
</Field>
<Field className="gap-1.5">
<FieldLabel htmlFor="email" className="text-sm">
Email
</FieldLabel>
<Input
id="email"
type="email"
name="email"
required
placeholder="name@example.com"
aria-label="Email"
className="dark:bg-background h-9 shadow-xs"
/>
</Field>
<Field className="gap-1.5">
<FieldLabel className="text-sm" htmlFor="password">
Password
</FieldLabel>
<Input
id="password"
type="password"
name="password"
required
aria-label="Password"
className="dark:bg-background h-9 shadow-xs"
/>
</Field>
<Field className="gap-1.5">
<FieldLabel className="text-sm" htmlFor="confirmPassword">
Confirm Password
</FieldLabel>
<Input
id="confirmPassword"
type="password"
name="confirmPassword"
required
aria-label="Confirm Password"
className="dark:bg-background h-9 shadow-xs"
/>
</Field>
</div>
<Field className="gap-4">
<Button type="submit" size="lg" className="rounded-lg h-10 hover:bg-primary/80 cursor-pointer">
Create Account
</Button>
<FieldDescription className="px-6 text-center text-sm leading-snug">
By creating an account, you agree to our <Link href="#">Terms of Service</Link> and{" "}
<Link href="#">Privacy Policy</Link>.
</FieldDescription>
<FieldDescription className="text-center text-sm font-normal text-muted-foreground">
Already have an account?{" "}
<Link href="#" className="font-medium text-card-foreground">
Sign in
</Link>
</FieldDescription>
</Field>
</FieldGroup>
</form>
</CardContent>
</Card>
)
}

export default SignUp
Original file line number Diff line number Diff line change
@@ -0,0 +1,101 @@
"use client"

import { Link } from "react-router"
import { Input } from "@/components/ui/input"
import { Button } from "@/components/ui/button"
import { Field, FieldDescription, FieldGroup, FieldLabel } from "@/components/ui/field"
import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card"

export const SignUp = () => {
return (
<Card className="max-w-lg px-6 py-8 sm:p-8 relative gap-6">
<CardHeader className="text-center gap-6 p-0">
<div className="flex flex-col gap-1">
<CardTitle className="text-2xl font-medium text-card-foreground">Welcome to Aura Stack</CardTitle>
<CardDescription className="text-sm text-muted-foreground font-normal">
Fill in the form below to create your account
</CardDescription>
</div>
</CardHeader>
<CardContent className="p-0">
<form>

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Set explicit safe form submission behavior for password inputs.

Line 21 currently relies on default form behavior (GET), which can expose credentials in the URL when submitted.

🔧 Suggested patch
-                <form>
+                <form method="post" onSubmit={(event) => event.preventDefault()}>
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
<form>
<form method="post" onSubmit={(event) => event.preventDefault()}>
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@packages/registry/src/registry/new-york/blocks/react-router/sign-up/sign-up.tsx`
at line 21, The <form> in sign-up.tsx currently uses the default GET behavior
which can expose credentials; update the form element in the SignUp component to
explicitly use a safe submission strategy by adding method="post" (and either an
explicit action or a JS onSubmit handler that calls event.preventDefault() and
securely handles the password submission via fetch/axios). Locate the <form> tag
in sign-up.tsx and change it to method="post" and implement a secure onSubmit
handler in the same component (e.g., handleSubmit) that prevents default
navigation and posts credentials over HTTPS.

<FieldGroup className="gap-6">
<div className="flex flex-col gap-4">
<Field className="gap-1.5">
<FieldLabel htmlFor="username" className="text-sm">
Username
</FieldLabel>
<Input
id="username"
type="text"
name="username"
required
placeholder="johndoe"
aria-label="Username"
className="dark:bg-background h-9 shadow-xs"
/>
</Field>
<Field className="gap-1.5">
<FieldLabel htmlFor="email" className="text-sm">
Email
</FieldLabel>
<Input
id="email"
type="email"
name="email"
required
placeholder="name@example.com"
aria-label="Email"
className="dark:bg-background h-9 shadow-xs"
/>
</Field>
<Field className="gap-1.5">
<FieldLabel className="text-sm" htmlFor="password">
Password
</FieldLabel>
<Input
id="password"
type="password"
name="password"
required
aria-label="Password"
className="dark:bg-background h-9 shadow-xs"
/>
</Field>
<Field className="gap-1.5">
<FieldLabel className="text-sm" htmlFor="confirmPassword">
Confirm Password
</FieldLabel>
<Input
id="confirmPassword"
type="password"
name="confirmPassword"
required
aria-label="Confirm Password"
className="dark:bg-background h-9 shadow-xs"
/>
</Field>
</div>
<Field className="gap-4">
<Button type="submit" size="lg" className="rounded-lg h-10 hover:bg-primary/80 cursor-pointer">
Create Account
</Button>
<FieldDescription className="px-6 text-center text-sm leading-snug">
By creating an account, you agree to our <Link to="#">Terms of Service</Link> and{" "}
<Link to="#">Privacy Policy</Link>.
</FieldDescription>
<FieldDescription className="text-center text-sm font-normal text-muted-foreground">
Already have an account?{" "}
<Link to="#" className="font-medium text-card-foreground">
Sign in
</Link>
</FieldDescription>
</Field>
</FieldGroup>
</form>
</CardContent>
</Card>
)
}

export default SignUp
Loading