fix(ui): replace tojson with single-quoted literals in Fetch Tools onclick#3616
fix(ui): replace tojson with single-quoted literals in Fetch Tools onclick#3616
Conversation
|
@omorros - thanks for your PR. Can you please solve the DCO check? You need |
…k handler Signed-off-by: Oriol Morros Vilaseca <OM368@student.aru.ac.uk>
1db790b to
07b0fbd
Compare
|
Sorry about that @marekdano Everything should work now with no issues! |
marekdano
left a comment
There was a problem hiding this comment.
@omorros - thanks for the PR!
The PR replaces tojson_attr with single-quoted JS literals, which is the correct fix for the HTML attribute parsing issue.
Root Cause Analysis
The tojson_attr filter outputs JSON with double quotes (e.g., "my-gateway"), which when placed inside a double-quoted onclick attribute creates:
onclick="fetchToolsForGateway("abc123", "my-gateway")"
This breaks HTML parsing because the browser sees the attribute ending at the first inner ", resulting in malformed HTML.
Why the PR Fix is Safe
Gateway names are strictly validated (mcpgateway/common/validators.py):
- Pattern: ^[a-zA-Z0-9_.- ]+$ (letters, numbers, underscore, dot, hyphen, space only)
- Explicitly rejects HTML special characters including single quotes (') and double quotes (")
- Maximum length: 255 characters
The PR's approach:
onclick="fetchToolsForGateway('{{ gateway.id }}', '{{ gateway.name }}')"
This is safe because:
- Gateway names cannot contain single quotes (validation prevents it)
- Gateway IDs are UUIDs (hex strings, no special characters)
- This matches the working pattern already used in admin.html line 5296
LGTM 🚀
|
Thanks for the contribution @omorros — the original bug report (#3082) was a real issue and your diagnosis of the However, this fix has been superseded by the introduction of the
Switching to raw Closing as superseded by #3350. Thanks again for reporting the issue and putting together the fix — it helped drive the proper solution. |
🔗 Related Issue Closes #3082
Supersedes #3179
📝 Summary
Replaced
tojson_attrwith single-quoted JS literals in the Fetch Tools button onclick handler ingateways_partial.html, fixing broken HTML parsing when double-quoted JSON strings appeared inside a double-quoted onclick attribute. This aligns the HTMX partial with the working pattern used elsewhere in the templates.🏷️ Type of Change
🧪 Verification
make lintmake test✅ Checklist
make black isort pre-commit)📓 Notes (optional)
Single-line change in
gateways_partial.html:42. The same button works correctly inadmin.html(initial page load)which already uses single quotes — this fix aligns the HTMX partial to match.