Skip to content

Renew documentaion site#921

Open
marcushohlbein wants to merge 43 commits intomainfrom
feature/update-documentaion
Open

Renew documentaion site#921
marcushohlbein wants to merge 43 commits intomainfrom
feature/update-documentaion

Conversation

@marcushohlbein
Copy link
Copy Markdown
Collaborator

No description provided.

Comment on lines +53 to +56
return text
.replace(/<br\s*\/?>/gi, ' ') // Replace <br> tags with space
.replace(/<[^>]+>/g, '') // Remove any other HTML tags
.replace(/\|/g, '\\|')

Check failure

Code scanning / CodeQL

Incomplete string escaping or encoding High documentation

This does not escape backslash characters in the input.

Copilot Autofix

AI 3 months ago

In general, when escaping characters for a specific output format, we must ensure that all metacharacters involved in escaping are handled consistently. For Markdown tables, that means not only escaping the pipe (|) used for column separation, but also escaping backslashes (\) themselves. Otherwise, sequences like \| can turn into \\| where only the | is escaped while the backslash changes meaning, or vice versa, leading to confusing output.

The single best fix here is to extend escapeTableCell to escape backslashes before escaping pipes and performing other replacements. We’ll add a .replace(/\\/g, '\\\\') step near the top of the chain (after the initial null/empty check, and before we start dealing with pipes and whitespace). This ensures every literal backslash in the input becomes a double backslash in the Markdown, so it is rendered as a literal backslash and does not interfere with subsequent escaping of |. No imports or additional helpers are needed; standard string replacement is sufficient. The change is localized to docs/scripts/generate-api-docs.ts, within the escapeTableCell function at lines 51–60.

Suggested changeset 1
docs/scripts/generate-api-docs.ts

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/docs/scripts/generate-api-docs.ts b/docs/scripts/generate-api-docs.ts
--- a/docs/scripts/generate-api-docs.ts
+++ b/docs/scripts/generate-api-docs.ts
@@ -53,6 +53,7 @@
   return text
     .replace(/<br\s*\/?>/gi, ' ') // Replace <br> tags with space
     .replace(/<[^>]+>/g, '') // Remove any other HTML tags
+    .replace(/\\/g, '\\\\') // Escape backslashes for markdown
     .replace(/\|/g, '\\|')
     .replace(/\n/g, ' ')
     .replace(/\r/g, '')
EOF
@@ -53,6 +53,7 @@
return text
.replace(/<br\s*\/?>/gi, ' ') // Replace <br> tags with space
.replace(/<[^>]+>/g, '') // Remove any other HTML tags
.replace(/\\/g, '\\\\') // Escape backslashes for markdown
.replace(/\|/g, '\\|')
.replace(/\n/g, ' ')
.replace(/\r/g, '')
Copilot is powered by AI and may make mistakes. Always verify output.
Comment on lines +53 to +55
return text
.replace(/<br\s*\/?>/gi, ' ') // Replace <br> tags with space
.replace(/<[^>]+>/g, '') // Remove any other HTML tags

Check failure

Code scanning / CodeQL

Incomplete multi-character sanitization High documentation

This string may still contain
<script
, which may cause an HTML element injection vulnerability.

Copilot Autofix

AI 3 months ago

In general, to fix incomplete multi‑character sanitization involving HTML, either use a robust sanitizer library (e.g., sanitize-html) or ensure that any dangerous characters (<, >, &, etc.) are reliably removed or escaped, not just when they appear inside patterns matched by a specific regex. Here, we only control a small helper, and the output is Markdown table cells, so the simplest safe fix is to strip any remaining < and > characters after we remove recognized tags. That guarantees that partial or malformed tags, or strings like <script that don’t match the tag regex, cannot survive.

Concretely, in docs/scripts/generate-api-docs.ts, adjust escapeTableCell so that after removing <br> and other HTML tags we also strip any residual < and > characters. We will add two additional .replace calls in the existing chain:

  • replace(/</g, '') to remove any remaining <.
  • replace(/>/g, '') to remove any remaining >.

We will insert these right after the existing tag‑removal .replace(/<[^>]+>/g, ''), keeping the rest of the logic (escaping |, normalizing whitespace) unchanged. No new imports or external libraries are required.

Suggested changeset 1
docs/scripts/generate-api-docs.ts

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/docs/scripts/generate-api-docs.ts b/docs/scripts/generate-api-docs.ts
--- a/docs/scripts/generate-api-docs.ts
+++ b/docs/scripts/generate-api-docs.ts
@@ -53,6 +53,8 @@
   return text
     .replace(/<br\s*\/?>/gi, ' ') // Replace <br> tags with space
     .replace(/<[^>]+>/g, '') // Remove any other HTML tags
+    .replace(/</g, '') // Remove any remaining '<' characters
+    .replace(/>/g, '') // Remove any remaining '>' characters
     .replace(/\|/g, '\\|')
     .replace(/\n/g, ' ')
     .replace(/\r/g, '')
EOF
@@ -53,6 +53,8 @@
return text
.replace(/<br\s*\/?>/gi, ' ') // Replace <br> tags with space
.replace(/<[^>]+>/g, '') // Remove any other HTML tags
.replace(/</g, '') // Remove any remaining '<' characters
.replace(/>/g, '') // Remove any remaining '>' characters
.replace(/\|/g, '\\|')
.replace(/\n/g, ' ')
.replace(/\r/g, '')
Copilot is powered by AI and may make mistakes. Always verify output.
Marcus Hohlbein added 28 commits February 16, 2026 17:40
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@marcushohlbein why can't we simply use readme.md file from components folder automatically generated by stencil on build? why do we need this custom api docs implementation

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

do we use these docs.json files? couldn't figure out so far how are they generated and where they are used. if we use it we need to fix relative paths I think

Comment thread release-please-config.json Outdated
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why did you remove release please config? we it replaced with smth or?

@marcushohlbein
Copy link
Copy Markdown
Collaborator Author

@copilot resolve the merge conflicts in this pull request

Co-authored-by: marcushohlbein <21499846+marcushohlbein@users.noreply.github.com>
Copy link
Copy Markdown

Copilot AI commented Apr 14, 2026

@copilot resolve the merge conflicts in this pull request

Merge conflicts resolved in commit 7f754da. The conflicts were in core/stencil.config.ts (removed browserHeadless/browserArgs settings that were deleted in main) and pnpm-lock.yaml (accepted main's updated lock file).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants