-
Notifications
You must be signed in to change notification settings - Fork 4k
1957 svg string fix #2666
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
1957 svg string fix #2666
Conversation
Mostly so CI will run it and give me a snapshot diff.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks great! If it's not too onerous, I think one additional test that asserts that SVGs are actually being run through our sanitizer would be useful as well (see comment above below).
|
|
||
| it("displays SVG images that load external images", () => { | ||
| cy.get("[data-testid='stImage'] svg") | ||
| .eq(0) | ||
| .matchImageSnapshot("karriebear-avatar"); | ||
| }); | ||
|
|
||
| it("displays links in text as text", () => { | ||
| cy.get("[data-testid='stImage'] svg") | ||
| .eq(1) | ||
| .should("contain", "avatars.githubusercontent"); | ||
| }); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Assuming it would be relatively easy to construct, could you add a test case that verifies that SVG sanitization is actually happening? Like, an SVG test string that will log to the console or open a modal or something else detectable - and a test that asserts that code doesn't actually get run?
(The test could either go in here, or possibly just in ImageList.test.tsx to prevent having to do all the e2e machinery.)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm just popping in to point out how I am now part of our codebase 😈
.matchImageSnapshot("karriebear-avatar");
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Good idea, I'll write that now
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It was actually not easy to construct, at least in a form that would make me confident my test could catch an issue if we didn't do sanitization, because either I'm writing the code wrong, or because the automatic partial jsx sanitization is catching it. Either way, I don't want to include a test for something if it will give unwarranted confidence that it would alert us if something started going wrong.
As suggested in code review.
* develop: Fix svg rendering in st.image() (streamlit#2666) Indicate widgets need to have labels (streamlit#2688) Clean up file update calls (streamlit#2597) Revert "🔧 "Run on save" now defaults to true (streamlit#2641)" (streamlit#2694)
* develop: Fix svg rendering in st.image() (streamlit#2666) Indicate widgets need to have labels (streamlit#2688) Clean up file update calls (streamlit#2597) Revert "🔧 "Run on save" now defaults to true (streamlit#2641)" (streamlit#2694)
Issue: #1957
Description: A continuation of the work done in #2003