feat: Glass icon buttons & Reddit feed content fix#10
Merged
devohmycode merged 1 commit intomasterfrom Feb 27, 2026
Merged
Conversation
- Replace plain buttons with 3D glass icon buttons (GlassIconButton) across SourcePanel, FeedPanel, BookmarkPanel, and NotePanel - Fix Reddit/Atom feeds not rendering post body text by adding getHtmlContent() that properly handles type="html" and type="xhtml" Atom content elements - Remove Ctrl+K hint from mode tab bar - Fix amoled theme for blob cards Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
Caution Review failedThe pull request is closed. ℹ️ Recent review infoConfiguration used: defaults Review profile: CHILL Plan: Pro 📒 Files selected for processing (8)
📝 WalkthroughWalkthroughThe changes introduce a new GlassIconButton component and refactor multiple panels (Bookmark, Feed, Note, Source) to use stylized glassy buttons for header actions, replacing standard buttons. CSS styling provides the glass aesthetic with layered effects and hover animations. An RSS service improvement enhances Atom content extraction. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Poem
✨ Finishing Touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Review Summary by Qodo
WalkthroughsDescription• Replace plain action buttons with 3D glass-effect GlassIconButton component across all panels • Fix Reddit/Atom feeds not rendering post body text by adding getHtmlContent() function • Improve spacing and styling for glass icon buttons in mode tab bar • Fix amoled theme styling for blob cards and remove Ctrl+K hint Diagramflowchart LR
A["RSS Service"] -->|"getHtmlContent()"| B["Atom Feed Parser"]
B -->|"Properly decode HTML content"| C["Feed Items with Body Text"]
D["Plain Buttons"] -->|"Replace with"| E["GlassIconButton Component"]
E -->|"Applied to"| F["SourcePanel, FeedPanel, BookmarkPanel, NotePanel"]
G["CSS Updates"] -->|"Add glass effect styles"| E
G -->|"Fix amoled theme"| H["Blob Cards"]
File Changes1. src/services/rssService.ts
|
Code Review by Qodo
1. Atom HTML XSS risk
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
Comment on lines
152
to
156
| description: getTextContent(entry, 'summary'), | ||
| pubDate: getTextContent(entry, 'published') || getTextContent(entry, 'updated'), | ||
| author: entry.querySelector('author name')?.textContent || '', | ||
| content: getTextContent(entry, 'content') || getTextContent(entry, 'summary'), | ||
| content: getHtmlContent(entry, 'content') || getTextContent(entry, 'content') || getTextContent(entry, 'summary'), | ||
| guid: getTextContent(entry, 'id') || link, |
There was a problem hiding this comment.
1. Atom html xss risk 🐞 Bug ⛨ Security
Atom <content> is now treated as HTML (including serialized XHTML) and flows into dangerouslySetInnerHTML rendering without sanitization. With the current Tauri CSP allowing unsafe-inline/unsafe-eval, a malicious feed can inject scriptable markup (e.g., event handlers) into the WebView.
Agent Prompt
## Issue description
Atom feed parsing now returns HTML markup (`getHtmlContent`) that is rendered with `dangerouslySetInnerHTML` in the Reader. Since feed content is untrusted and the Tauri CSP allows inline/eval scripts, this can enable XSS via event-handler attributes or other scriptable HTML.
## Issue Context
- Atom entries can provide `content` as `type="html"` or `type="xhtml"`; the new helper serializes/returns markup.
- The reader injects this HTML into the DOM.
## Fix Focus Areas
- src/services/rssService.ts[36-52]
- src/services/rssService.ts[141-167]
- src/components/ReaderPanel.tsx[1175-1180]
- src-tauri/tauri.conf.json[27-29]
## Implementation notes
- Add a small `sanitizeFeedHtml(html: string): string` utility (DOMParser-based allowlist) and apply it to `item.content` (and `item.fullContent` if also untrusted) before rendering.
- Ensure removal of `on*` attributes and `javascript:`/`data:` URLs in `href/src` as appropriate.
- If feasible, reduce CSP permissiveness (especially `unsafe-inline`/`unsafe-eval`).
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
GlassIconButtoncomponent across SourcePanel, FeedPanel, BookmarkPanel, and NotePanelgetTextContent()was used on<content type="html">elements. AddedgetHtmlContent()to properly decode HTML content from Atom feedsTest plan
🤖 Generated with Claude Code
Summary by CodeRabbit
Release Notes
New Features
UI/UX Improvements