[Bugfix:Forum] Escape raw HTML in Markdown rendering#12480
Conversation
automateprojectmangement
Bot
moved this from Seeking Reviewer
to In Review
in Submitty Development
There was a problem hiding this comment.
Pull request overview
This PR updates the shared Vue Markdown renderer used by forum posts, grade inquiry posts, and the /markdown preview endpoint to prevent angle-bracketed text (e.g., Node <T>, List<String>) from being interpreted as raw HTML and disappearing in rendered output.
Changes:
- Adjusts the KaTeX inline LaTeX Marked extension to use a dedicated custom token type with a custom renderer.
- Adds HTML escaping for Marked
htmltokens so raw HTML is displayed as text (fixing the<T>disappearing case). - Wires the escaping behavior into the Marked instance used by
Markdown.vue.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
@williamjallen can you look into it |
github-actions
Bot
added
the
Abandoned PR - Needs New Owner
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #12480 +/- ##
=========================================
Coverage 21.67% 21.67%
Complexity 9807 9807
=========================================
Files 268 268
Lines 36722 36722
Branches 490 490
=========================================
Hits 7960 7960
Misses 28276 28276
Partials 486 486
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
roye2
left a comment
roye2
left a comment
There was a problem hiding this comment.
I verified that the changes work and everything looks good. I was able to write an example of some c++ code with the angle brackets being functional. Latex still worked as well. I also tried to get an HTML <script> tag to render (security issue), but the code prevents this from happening by escaping the characters. As far as I am concerned this PR is ready to be merged!
github-project-automation
Bot
moved this from In Review
to Awaiting Maintainer Review
in Submitty Development
Why is this Change Important & Necessary?
Fixes #12285
Special characters inside angle brackets (e.g.,
Node <T>,List<String>) disappear when rendered in grade inquiry posts and discussion forum posts with markdown enabled.What is the New Behavior?
Before:
Node <T>renders asNodeAfter:
Node <T>renders asNode <T>What steps should a reviewer take to reproduce or test the bug or new feature?
Node <T>orList<String>`<T>`renders in a code block)Automated Testing & Documentation
Other information
The fix applies to both the Discussion Forum and Grade Inquiry since they share the same
Markdown.vuecomponent viaRenderPost.twigi think this is enoughRaw HTML in markdown posts is now escaped (rendered as literal text), matching the server-side CommonMark behavior (html_input => 'escape' in Output.php). This is intentional, user-submitted posts should not contain raw HTML for security reasons. Users can still use markdown syntax for formatting.