chore: Add Markdown Validation to OpenGraph Remediations and Kind Info Inputs - BED-8964 - #3092
Merged
Conversation
- Adds 'orphaned' status to attack-paths.attack-paths-findings.yaml doc Resolves BED-8602
merging with main
merging with main
- adds orphaned status to documentation again
merging with main
merging with main
merge with main
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Organization UI (inherited) Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThe change adds Markdown extraction to kind information inputs. It validates kind and remediation Markdown during graph extension upserts by rendering, sanitizing, and normalizing HTML before persistence. ChangesGraph extension Markdown validation
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant UpsertOpenGraphExtension
participant KindInfoInput
participant markdownValidator
participant Repository
participant GraphKindRefresh
UpsertOpenGraphExtension->>KindInfoInput: Extract Markdown content
KindInfoInput-->>UpsertOpenGraphExtension: Markdown text or extraction error
UpsertOpenGraphExtension->>markdownValidator: Validate kind and remediation Markdown
markdownValidator-->>UpsertOpenGraphExtension: Validation result
UpsertOpenGraphExtension->>Repository: Upsert validated extension
Repository-->>UpsertOpenGraphExtension: Upsert result
UpsertOpenGraphExtension->>GraphKindRefresh: Refresh graph kinds
Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Comment |
coderabbitai
Bot
added
api
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
cmd/api/src/model/graphschema.go (1)
123-143: 📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick winConsolidate duplicate Markdown-content decoding logic.
validateKindInfoContent(Line 123) and the newMarkdownContent(Line 148) decode the same{"markdown":{"content":"..."}}JSON shape with the sameDisallowUnknownFieldsand nil-check logic. Keep one implementation. LetvalidateKindInfoContentcallMarkdownContentand discard the string, so future contract changes only need one update.♻️ Proposed refactor to remove duplication
func validateKindInfoContent(content json.RawMessage) error { - var ( - contentWrapper struct { - Markdown struct { - Content *string `json:"content"` - } `json:"markdown"` - } - decoder = json.NewDecoder(strings.NewReader(string(content))) - ) - - decoder.DisallowUnknownFields() - if err := decoder.Decode(&contentWrapper); err != nil { - return ErrInvalidKindInfoContent - } - - if contentWrapper.Markdown.Content == nil { - return ErrInvalidKindInfoContent - } - - return nil + _, err := KindInfoInput{Content: content}.MarkdownContent() + return err }Also applies to: 145-167
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@cmd/api/src/model/graphschema.go` around lines 123 - 143, Consolidate the duplicate decoding logic by updating validateKindInfoContent to call MarkdownContent and discard its returned string, propagating any validation error. Remove the local decoder, wrapper, unknown-field handling, and nil check from validateKindInfoContent while preserving its existing error contract and keeping MarkdownContent as the single implementation.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@cmd/api/src/services/opengraphschema/markdownsanitize.go`:
- Around line 1-2: Prepend the current header from LICENSE.header before the
package declaration in both
cmd/api/src/services/opengraphschema/markdownsanitize.go (lines 1-2) and
cmd/api/src/services/opengraphschema/markdownsanitize_test.go (lines 1-2); no
other changes are needed.
- Around line 30-41: Update newMarkdownValidator and its validation policy to
preserve safe GFM table alignment style attributes and fenced-code language
classes, either by allowing constrained values or configuring goldmark to omit
them; ensure validate accepts both cases. Add coverage for aligned tables and
language-tagged fenced code, and add the required LICENSE.header to
markdownsanitize.go and markdownsanitize_test.go.
---
Outside diff comments:
In `@cmd/api/src/model/graphschema.go`:
- Around line 123-143: Consolidate the duplicate decoding logic by updating
validateKindInfoContent to call MarkdownContent and discard its returned string,
propagating any validation error. Remove the local decoder, wrapper,
unknown-field handling, and nil check from validateKindInfoContent while
preserving its existing error contract and keeping MarkdownContent as the single
implementation.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: 8d66e6e9-dda9-44f3-a970-a40641a2920f
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (8)
cmd/api/src/model/graphschema.gocmd/api/src/model/graphschema_test.gocmd/api/src/services/opengraphschema/extension.gocmd/api/src/services/opengraphschema/extension_test.gocmd/api/src/services/opengraphschema/markdownsanitize.gocmd/api/src/services/opengraphschema/markdownsanitize_test.gocmd/api/src/services/opengraphschema/opengraphschema.gogo.mod
merge with main
brandonshearin
approved these changes
Aug 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Motivation and Context
Resolves: BED-8964
The OpenGraph Extension upload endpoint needs to validate and sanitize any markdown thats supplied as part of the extension: entity panels (kind info) and remediations.
How Has This Been Tested?
Screenshots (optional):
Types of changes
Checklist:
Summary by CodeRabbit
New Features
Bug Fixes