Skip to content

Conversation

@Parasaran-Python
Copy link
Contributor

@Parasaran-Python Parasaran-Python commented Dec 15, 2024

fix #235221: Sanitizing the html content and closing the unclosed tags

The unclosed comment tag in markdown causes a breakage in the final html thats generated by the markdown rendering engine.

The script tags for markdown preview which are dynamically inserted to the DOM are engulfed by the unclosed comment tag and are then treated as a part of the comment by the JS engine.

@Parasaran-Python
Copy link
Contributor Author

In case the explanation in the description wasnt very clear

image

Check the script tag, this is how its expected to be

Due to the unclosed tag in markdown
image

Its rendered as a comment inside the above div tag, thereby causing the breakage

other events like showing markdown text content on dblClick are also not bound due to this breakage.

@mjbvz could you please go through this PR and provide your inputs.

@Parasaran-Python Parasaran-Python changed the title fix 235221: Sanitizing the html content and closing the unclosed tags fix 235221: Sanitizing the html content by closing the unclosed tags Dec 15, 2024
@Parasaran-Python Parasaran-Python force-pushed the 235221 branch 2 times, most recently from 1a563b6 to c39e4cd Compare December 16, 2024 15:38
Copy link
Collaborator

@mjbvz mjbvz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for taking a look. However I don't think this is the right approach

Using a regex to try fixing/sanitizing html is not robust. Instead I think we should try switching to use proper dom apis

  1. pass the rendered markdown into the webview, for example in vscode-markdown-preview-data
  2. In the webview scripts, use something like innerHTML to write the rendered markdown into the document on load

let me know if you have any questions about this

@Parasaran-Python
Copy link
Contributor Author

Parasaran-Python commented Dec 17, 2024

Thanks for taking a look. However I don't think this is the right approach

Using a regex to try fixing/sanitizing html is not robust. Instead I think we should try switching to use proper dom apis

1. pass the rendered markdown into the webview, for example in `vscode-markdown-preview-data`

2. In the webview scripts, use something like `innerHTML` to write the rendered markdown into the document on load

let me know if you have any questions about this

It seems that the DOM APIs didn’t work on this page, perhaps because it’s not being executed in a browser environment. As a result, I had to resort to using regex.

image

May be some 3rd party node package can help, dompurify as well is not supported outside browser env.

I’ll consider an alternative approach for this. If you have any suggestions or recommendations, I’d be happy to hear them!

@Parasaran-Python
Copy link
Contributor Author

@mjbvz I think I understood what you are trying to convey,

image

You suggest passing the markdown content inside an attribute of the shown meta tag

And consuming it inside webview like this

image

Please correct me if I'm wrong.

@mjbvz
Copy link
Collaborator

mjbvz commented Dec 17, 2024

Yes that sounds correct 👍

@Parasaran-Python
Copy link
Contributor Author

Parasaran-Python commented Dec 17, 2024

Yes that sounds correct 👍

@mjbvz I have made the changes to the best of my understanding, could you please re-review.

Fix seems to work fine with the markdown given on the issue.

Thanks.

@Parasaran-Python
Copy link
Contributor Author

Seems like a " in markdown is breaking things, will check.

@Parasaran-Python
Copy link
Contributor Author

Encode and decode seems to fix it,

Tried multiple special chars,

image

works fine.

@mjbvz mjbvz enabled auto-merge December 17, 2024 19:47
@vs-code-engineering vs-code-engineering bot added this to the January 2025 milestone Dec 17, 2024
@mjbvz mjbvz merged commit 5e26b3d into microsoft:main Dec 17, 2024
7 checks passed
mjbvz added a commit to mjbvz/vscode that referenced this pull request Dec 17, 2024
- Don't send content as json
- Reuse existing load helper
mjbvz added a commit that referenced this pull request Dec 17, 2024
@vs-code-engineering vs-code-engineering bot locked and limited conversation to collaborators Jan 31, 2025
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Unclosed markdown comment at the end of the file causes local markdown link at the start of the file to malfunction

3 participants