merge queue: checking main (d122a6d) and #12304 together - #12330
Closed
mergify[bot] wants to merge 2 commits into
Closed
merge queue: checking main (d122a6d) and #12304 together#12330mergify[bot] wants to merge 2 commits into
mergify[bot] wants to merge 2 commits into
Conversation
`renderMarkdown` output goes straight into `dangerouslySetInnerHTML` in six tables, and it did not filter URL protocols: `remark-rehype` emits an `<a>` for any link target whatever its scheme, so a `javascript:` link in a synced description would have rendered as a live link. Raw HTML was never a way in — `remark-rehype` runs without `allowDangerousHtml`, so it is discarded before becoming a node — which makes URL filtering the whole of what `rehype-sanitize` adds here. It sits after `rehype-raw` so that if a caller ever does enable `allowDangerousHtml`, the embedded markup is parsed and then sanitized rather than passed through opaque. Every input today is first-party: descriptions generated by our own engine and delivered by our own sync bot. So this is defence in depth rather than a live exposure — but "the input is trustworthy" is a property of the six current callers, not of the function, and the output lands somewhere that makes the distinction expensive to get wrong later. The tests separate the two guarantees on purpose. Asserting all four cases together would have been misleading: three of them pass with the sanitizer removed, because they test the markdown pipeline discarding raw HTML rather than anything the sanitizer does. Only the URL-protocol cases fail if it goes. Output is unchanged across every description the two schemas publish. Part of MRGFY-8330 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Change-Id: Ice1642f855d6698b65a034e398affbce16f822a6
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🎉 This pull request has been checked successfully and will be merged soon. 🎉
Branch main (d122a6d) and #12304 are queued together for merge.
This pull request has been created by Mergify to check the mergeability of #12304.
You don't need to do anything. Mergify will close this pull request automatically when it is complete.
Required conditions of queue rule
defaultfor merge:depends-on = Mergifyio/docs#12293[⛓️ refactor(docs): read documented enum values through one shared reader #12293]github-review-approved[🛡 GitHub repository ruleset ruleRequire pull request for default branch]schedule=Mon-Fri 09:00-17:30[Europe/Paris]Enforce conventional commit]:title ~= ^(fix|feat|internal|docs|style|refactor|perf|test|build|ci|chore|revert|ui)(?:\(.+\))?!?:👀 Review Requirements]:#approved-reviews-by >= 2author = dependabot[bot]author = mergify-ci-bot-head ~= ^docs-agent/📕 PR description]:body ~= (?ms:.{48,})🔎 Reviews]:#changes-requested-reviews-by = 0#review-requested = 0#review-threads-unresolved = 0🤖 Continuous Integration]:check-success = buildcheck-success = lintcheck-success = testcheck-success = test-broken-linkslabel = ignore-broken-linkscheck-success=Cloudflare Pages-head-repo-full-name~=^Mergifyio/Required conditions to stay in the queue:
depends-on = Mergifyio/docs#12293[⛓️ refactor(docs): read documented enum values through one shared reader #12293]github-review-approved[🛡 GitHub repository ruleset ruleRequire pull request for default branch]Enforce conventional commit]:title ~= ^(fix|feat|internal|docs|style|refactor|perf|test|build|ci|chore|revert|ui)(?:\(.+\))?!?:👀 Review Requirements]:#approved-reviews-by >= 2author = dependabot[bot]author = mergify-ci-bot-head ~= ^docs-agent/📕 PR description]:body ~= (?ms:.{48,})🔎 Reviews]:#changes-requested-reviews-by = 0#review-requested = 0#review-threads-unresolved = 0🤖 Continuous Integration]:check-success = buildcheck-success = lintcheck-success = testcheck-success = test-broken-linkslabel = ignore-broken-linkscheck-success=Cloudflare Pages-head-repo-full-name~=^Mergifyio/author != dependabot[bot]author != mergify-ci-bothead ~= ^docs-agent/