Fix and consolidate markup escaping in CLI#14749
Merged
JamesNK merged 2 commits intorelease/13.2from Mar 1, 2026
Merged
Conversation
Contributor
|
🚀 Dogfood this PR with:
curl -fsSL https://raw.githubusercontent.com/dotnet/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 14749Or
iex "& { $(irm https://raw.githubusercontent.com/dotnet/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 14749" |
Contributor
🎬 CLI E2E Test RecordingsThe following terminal recordings are available for commit
📹 Recordings uploaded automatically from CI run #22531201402 |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR addresses a security and usability issue where external content containing Spectre.Console markup characters (like brackets []) would cause exceptions or unintended rendering in CLI output. The solution adds auto-escaping by default to display methods and introduces a separate emojiName parameter to cleanly separate emoji formatting from message text.
Changes:
- Added auto-escaping by default to
DisplayMessage,DisplaySuccess,DisplaySubtleMessage, andShowStatusAsync/ShowStatusmethods with an optionalallowMarkupparameter to opt-in to markup rendering - Introduced
emojiNameparameter toShowStatusAsync/ShowStatusto handle emoji separately from status text, enabling proper auto-escaping while preserving emoji rendering - Added
EmojiWidthutility class to calculate terminal cell widths for emoji, handling Unicode presentation properties for consistent emoji alignment - Consolidated
TableExtensions.AddBoldColumnoverloads into a single method with optional parameters - Updated all call sites to use the new signatures, with several removing manual
.EscapeMarkup()calls - Added comprehensive test coverage for the escaping behavior
- Added debug-only
RenderCommandfor testing CLI rendering
Reviewed changes
Copilot reviewed 35 out of 35 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
src/Aspire.Cli/Utils/EmojiWidth.cs |
New utility class for calculating emoji display widths based on Unicode Emoji_Presentation property |
tests/Aspire.Cli.Tests/Utils/EmojiWidthTests.cs |
Tests for emoji width calculation |
src/Aspire.Cli/Interaction/IInteractionService.cs |
Updated interface signatures to add emojiName and allowMarkup parameters |
src/Aspire.Cli/Interaction/ConsoleInteractionService.cs |
Implemented auto-escaping logic and emoji prefix formatting |
src/Aspire.Cli/Interaction/ExtensionInteractionService.cs |
Updated wrapper to forward new parameters |
tests/Aspire.Cli.Tests/Interaction/ConsoleInteractionServiceTests.cs |
Comprehensive tests for auto-escaping, allowMarkup, and emojiName behavior |
tests/Aspire.Cli.Tests/Utils/ConsoleActivityLoggerTests.cs |
Tests for markup escaping in activity logger output |
src/Aspire.Cli/Utils/TableExtensions.cs |
Consolidated three AddBoldColumn overloads into one with optional parameters |
src/Aspire.Cli/Utils/ConsoleActivityLogger.cs |
Added escaping for failure reasons and pipeline summary keys/values |
| Multiple command files | Updated to use emojiName parameter and removed manual .EscapeMarkup() calls where appropriate |
src/Aspire.Cli/Commands/RenderCommand.cs |
New DEBUG-only command for testing CLI rendering |
| Test service mocks | Updated to match new interface signatures |
This was referenced Feb 27, 2026
This was referenced Feb 27, 2026
davidfowl
approved these changes
Feb 28, 2026
JamesNK
force-pushed
the
jamesnk/markup-escape
branch
from
c3a33cf to
56209ca
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The CLI interaction service has methods like
DisplayMessageandDisplaySuccessthat are rendered using markup. That means callers must escape external content or get problems when content contains markup characters. This is non-obvious and it's very easy to include external content in these methods.This PR:
DisplayMarkupShowStatusAsync. Allows message to be escaped by defaultRenderCommand. It's a test bed for smoke testing render output. Hidden and excluded from non-debug builds.KnownEmojis. List of emojis used in the CLI. Fix some invalid emojis.Checklist
<remarks />and<code />elements on your triple slash comments?aspire.devissue: