Render code blocks in repo description #26830
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
GiteaBot
added
the
lgtm/need 2
pull-request-size
bot
added
the
size/XS
pull-request-size
bot
added
size/S
delvh
reviewed
Aug 30, 2023
| @@ -8,7 +8,7 @@ | |||
| <div class="ui repo-description"> | |||
| <div id="repo-desc"> | |||
| {{$description := .Repository.DescriptionHTML $.Context}} | |||
| {{if $description}}<span class="description">{{$description}}</span>{{else if .IsRepositoryAdmin}}<span class="no-description text-italic">{{.locale.Tr "repo.no_desc"}}</span>{{end}} | |||
| {{if $description}}<span class="description">{{$description | RenderCodeBlock}}</span>{{else if .IsRepositoryAdmin}}<span class="no-description text-italic">{{.locale.Tr "repo.no_desc"}}</span>{{end}} | |||
There was a problem hiding this comment.
Surprising that that passes the validation…
I would expect that to escape the HTML tags as it is (obviously) unsafe…
There was a problem hiding this comment.
You are right, it's possible to inject HTML here, wonder if that was the case before. Any suggestions how to fix?
There was a problem hiding this comment.
Can confirm HTML injection was possible before. It's sanitized but imho we should remove this.
There was a problem hiding this comment.
Could also be that this injection is somewhat intentional if the title is rendered like other markdown. Question is really if we want this thought as it allows the user to break page layout in the repo title, which imho is to be avoided.
delvh
approved these changes
Aug 30, 2023
GiteaBot
added
lgtm/need 1
wxiaoguang
reviewed
Aug 31, 2023
|
I guess we can merge this now and defer the discussion about HTML rendering in repo description to later, to not expand the scope of this change. |
wxiaoguang
approved these changes
Aug 31, 2023
GiteaBot
added
lgtm/done
wxiaoguang
added
the
reviewed/wait-merge
GiteaBot
removed
the
reviewed/wait-merge
zjjhot
added a commit
to zjjhot/gitea
that referenced
this pull request
Sep 1, 2023
* giteaoffical/main: (22 commits) Use case-insensitive regex for all webpack assets (go-gitea#26867) restrict certificate type for builtin SSH server (go-gitea#26789) feat(API): add secret deletion functionality for repository (go-gitea#26808) Avoid double-unescaping of form value (go-gitea#26853) Move web/api context related testing function into a separate package (go-gitea#26859) Remove some unused CSS styles (go-gitea#26852) [skip ci] Updated translations via Crowdin Minor dashboard tweaks, fix flex-list margins (go-gitea#26829) Update team invitation email link (go-gitea#26550) Redirect from `{repo}/issues/new` to `{repo}/issues/new/choose` when blank issues are disabled (go-gitea#26813) Remove "TODO" tasks from CSS file (go-gitea#26835) User details page (go-gitea#26713) Render code blocks in repo description (go-gitea#26830) Remove joinPaths function (go-gitea#26833) Remove polluted `.ui.right` (go-gitea#26825) Sync tags when adopting repos (go-gitea#26816) rm comment about hugo (go-gitea#26832) Fix filename for .spectral.yaml (go-gitea#26828) [skip ci] Updated translations via Crowdin Check blocklist for emails when adding them to account (go-gitea#26812) ...
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Backtick syntax now works in repo description too. Also, I replaced the CSS for this was a new single class, making it more flexible and not dependent on a parent. Also, very slightly reduced font size from 16.8px to 16px.