Skip to content

Un-escaped HTML tags may cause markdown renderers to render the HTML #697

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
rwols opened this issue Feb 25, 2023 · 3 comments
Open

Un-escaped HTML tags may cause markdown renderers to render the HTML #697

rwols opened this issue Feb 25, 2023 · 3 comments

Comments

@rwols
Copy link

rwols commented Feb 25, 2023

Some docstrings contain HTML, but they should be escaped. e.g. hover over a react-router-dom Link component and the response is

:: [20:21:32.099] --> LSP-typescript textDocument/hover (1615): {'textDocument': {'uri': 'file:///media/Work/code/vault/src/routes/Root.tsx'}, 'position': {'character': 22, 'line': 14}}


: [20:21:32.102] <<< LSP-typescript (1615) (duration: 2ms): {'contents': {'kind': 'markdown', 'value': '\n```typescript\n(alias) const Link: React.ForwardRefExoticComponent<LinkProps & React.RefAttributes<HTMLAnchorElement>>\nimport Link\n```\nThe public API for rendering a history-aware <a>.'}, 'range': {'end': {'character': 23, 'line': 14}, 'start': {'character': 19, 'line': 14}}}

In the markdown value, should the < and > in React.ForwardRefExoticComponent<LinkProps & React.RefAttributes<HTMLAnchorElement>> as well as in <a> be escaped? I think they should be escaped, since markdown may contain HTML for markup.
@rwols
Copy link
Author

rwols commented Feb 25, 2023

This is how it renders in ST. I see now that the React.ForwardRefExoticComponent<LinkProps & React.RefAttributes<HTMLAnchorElement>> ia rendered correctly because it's in a code block. But the <a> tag is not rendered.

hover-ts

@rchl
Copy link
Member

rchl commented Feb 25, 2023

Is it any better in VSCode (if you have a way to test)?

@rchl
Copy link
Member

rchl commented Feb 25, 2023

I don't work with React so I'm not sure how to even reproduce this but this is probably an equivalent case:

/**
 * Test <a> rendering.
 */
const xxxx = 1

which results in:

Screenshot 2023-02-25 at 23 58 45

Treating it as markdown and escaping html using backticks would help:

/**
 * Test `<a>` rendering.
 */
const xxxx = 1

Screenshot 2023-02-25 at 23 59 22

While this server does some processing of the input provided by typescript (mostly just handling of JSDoc @tags), I'm not convinced that it should go into trying to parse HTML as that's just a slippery slope. I think it's something that should be handled properly when authoring the comments.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@rchl @rwols