Repository navigation
web: escape page title and consoles link in the UI index - #20078
Open
Thanatos9404 wants to merge 2 commits into
Open
Thanatos9404 wants to merge 2 commits into
Thanatos9404 wants to merge 2 commits into
Conversation
Move the placeholder replacement for the React app's index.html out of the serveReactApp closure into renderReactIndex, so it can be tested without the built UI assets. No behaviour change. Signed-off-by: Yashvardhan Thanvi <[email protected]>
The page title and the consoles link were written into the UI's index.html unescaped. The consoles link sits in a quoted JavaScript string in an inline script, and the external URL path is decoded before it gets there, so --web.external-url=http://host/it%27s/ together with a consoles directory made the script fail to parse and left the UI blank. A page title containing markup such as </title> ended the title element early. Escape the consoles link with template.JSEscapeString and the title with html.EscapeString. Values without special characters are written exactly as before. Signed-off-by: Yashvardhan Thanvi <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
@juliusv, a small fix in how the UI's index.html is served.
serveReactAppwrites the flag values into index.html with plain byte replacement. The consoles link lands in a single-quoted JavaScript string in an inline script, and the external URL path is decoded at that point, so--web.external-url=http://host/it%27s/with a consoles directory rendersconst GLOBAL_CONSOLES_LINK='/it's/consoles/index.html';. That script fails to parse, the globals are never defined, and the UI comes up blank. A--web.page-titlesuch asStaging </title><b>QA</b>ends the title element early and the rest is parsed as markup.The substitution now lives in a small method that escapes the consoles link with
template.JSEscapeStringand the title withhtml.EscapeString. Values without special characters come out exactly as before. One visible change: a title written with HTML entities such as&now shows them literally.A new table test runs the index.html templates of both UIs through the method and fails without the escaping;
go test ./web/...and golangci-lint pass.Which issue(s) does the PR fix:
None, there is no issue for this.
Release notes for end users (ALL commits must be considered).
Reviewers should verify clarity and quality.