Renew documentaion site#921
Conversation
| return text | ||
| .replace(/<br\s*\/?>/gi, ' ') // Replace <br> tags with space | ||
| .replace(/<[^>]+>/g, '') // Remove any other HTML tags | ||
| .replace(/\|/g, '\\|') |
Check failure
Code scanning / CodeQL
Incomplete string escaping or encoding High documentation
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 3 months ago
In general, when escaping characters for a specific output format, we must ensure that all metacharacters involved in escaping are handled consistently. For Markdown tables, that means not only escaping the pipe (|) used for column separation, but also escaping backslashes (\) themselves. Otherwise, sequences like \| can turn into \\| where only the | is escaped while the backslash changes meaning, or vice versa, leading to confusing output.
The single best fix here is to extend escapeTableCell to escape backslashes before escaping pipes and performing other replacements. We’ll add a .replace(/\\/g, '\\\\') step near the top of the chain (after the initial null/empty check, and before we start dealing with pipes and whitespace). This ensures every literal backslash in the input becomes a double backslash in the Markdown, so it is rendered as a literal backslash and does not interfere with subsequent escaping of |. No imports or additional helpers are needed; standard string replacement is sufficient. The change is localized to docs/scripts/generate-api-docs.ts, within the escapeTableCell function at lines 51–60.
| @@ -53,6 +53,7 @@ | ||
| return text | ||
| .replace(/<br\s*\/?>/gi, ' ') // Replace <br> tags with space | ||
| .replace(/<[^>]+>/g, '') // Remove any other HTML tags | ||
| .replace(/\\/g, '\\\\') // Escape backslashes for markdown | ||
| .replace(/\|/g, '\\|') | ||
| .replace(/\n/g, ' ') | ||
| .replace(/\r/g, '') |
| return text | ||
| .replace(/<br\s*\/?>/gi, ' ') // Replace <br> tags with space | ||
| .replace(/<[^>]+>/g, '') // Remove any other HTML tags |
Check failure
Code scanning / CodeQL
Incomplete multi-character sanitization High documentation
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 3 months ago
In general, to fix incomplete multi‑character sanitization involving HTML, either use a robust sanitizer library (e.g., sanitize-html) or ensure that any dangerous characters (<, >, &, etc.) are reliably removed or escaped, not just when they appear inside patterns matched by a specific regex. Here, we only control a small helper, and the output is Markdown table cells, so the simplest safe fix is to strip any remaining < and > characters after we remove recognized tags. That guarantees that partial or malformed tags, or strings like <script that don’t match the tag regex, cannot survive.
Concretely, in docs/scripts/generate-api-docs.ts, adjust escapeTableCell so that after removing <br> and other HTML tags we also strip any residual < and > characters. We will add two additional .replace calls in the existing chain:
replace(/</g, '')to remove any remaining<.replace(/>/g, '')to remove any remaining>.
We will insert these right after the existing tag‑removal .replace(/<[^>]+>/g, ''), keeping the rest of the logic (escaping |, normalizing whitespace) unchanged. No new imports or external libraries are required.
| @@ -53,6 +53,8 @@ | ||
| return text | ||
| .replace(/<br\s*\/?>/gi, ' ') // Replace <br> tags with space | ||
| .replace(/<[^>]+>/g, '') // Remove any other HTML tags | ||
| .replace(/</g, '') // Remove any remaining '<' characters | ||
| .replace(/>/g, '') // Remove any remaining '>' characters | ||
| .replace(/\|/g, '\\|') | ||
| .replace(/\n/g, ' ') | ||
| .replace(/\r/g, '') |
…cumentation build
…n for documentation
… documentation build process
… and specify output directory
… version in package.json
…rsion in package.json
…n mode from .npmrc
…om pnpm workspace
…y in firebase.json
There was a problem hiding this comment.
@marcushohlbein why can't we simply use readme.md file from components folder automatically generated by stencil on build? why do we need this custom api docs implementation
There was a problem hiding this comment.
do we use these docs.json files? couldn't figure out so far how are they generated and where they are used. if we use it we need to fix relative paths I think
There was a problem hiding this comment.
why did you remove release please config? we it replaced with smth or?
…ce alert component description
…d logging options
|
@copilot resolve the merge conflicts in this pull request |
Co-authored-by: marcushohlbein <21499846+marcushohlbein@users.noreply.github.com>
Merge conflicts resolved in commit |
No description provided.