Add interactive release note generator#649
Conversation
Greptile SummaryAdds a self-contained interactive release notes tool under
Confidence Score: 4/5
Important Files Changed
Last reviewed commit: 4b56ae7 |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
…aging commits and generating markdown. Run yarn gen-data -v <version> to pull commits since a tag, then yarn dev to launch a Vite app where you can mark commits to include, tag and group them, filter the list, and get a live markdown preview with copy-to-clipboard. Triage state persists to a local JSON file.
| let content = escapeHtml(line.slice(2)); | ||
| // Links: [text](url) | ||
| content = content.replace( | ||
| /\[([^\]]+)\]\(([^)]+)\)/g, | ||
| '<a href="$2" target="_blank">$1</a>' |
There was a problem hiding this comment.
markdownToHtml can render javascript: links from commit summaries
The escapeHtml call on line 74 escapes <, >, and &, but does not affect markdown link syntax ([text](url)). The subsequent link regex on lines 76-78 then converts these into raw <a href="$2"> tags via dangerouslySetInnerHTML (line 184).
If a commit summary contains markdown link syntax like [click](javascript:alert(1)), it passes through escapeHtml unchanged (no HTML chars to escape), the link regex matches it, and the result is an <a href="javascript:alert(1)"> element rendered in the DOM.
Since this is a local dev tool processing commits from your own repo, the risk is low — but it's worth sanitizing the href capture to only allow http:/https: protocols, especially since escapeHtml also doesn't escape " which could allow attribute breakout via crafted URLs containing double quotes.
Prompt To Fix With AI
This is a comment left during a code review.
Path: scripts/release-notes/src/components/ReleaseNotes.jsx
Line: 74-78
Comment:
**`markdownToHtml` can render `javascript:` links from commit summaries**
The `escapeHtml` call on line 74 escapes `<`, `>`, and `&`, but does not affect markdown link syntax (`[text](url)`). The subsequent link regex on lines 76-78 then converts these into raw `<a href="$2">` tags via `dangerouslySetInnerHTML` (line 184).
If a commit summary contains markdown link syntax like `[click](javascript:alert(1))`, it passes through `escapeHtml` unchanged (no HTML chars to escape), the link regex matches it, and the result is an `<a href="javascript:alert(1)">` element rendered in the DOM.
Since this is a local dev tool processing commits from your own repo, the risk is low — but it's worth sanitizing the `href` capture to only allow `http:`/`https:` protocols, especially since `escapeHtml` also doesn't escape `"` which could allow attribute breakout via crafted URLs containing double quotes.
How can I resolve this? If you propose a fix, please make it concise.
| const commits = listOfCommits.split('\n').map((commitMessage, index) => { | ||
| const diffMatch = body[index]?.match(/D\d+/); | ||
| const diff = diffMatch != null && diffMatch[0]; | ||
| const [hash, date, name] = commitMessage.split('|'); |
There was a problem hiding this comment.
Pipe delimiter can split author names incorrectly
The format string on line 78 is %h|%ai|%aN|%ae, producing 4 pipe-delimited fields. The destructuring here only captures 3 values (hash, date, name), which works in the common case. However, if an author's Git display name (%aN) contains a | character, split('|') would produce more than 4 segments, and name would be truncated to only the portion before the first | in the name.
Consider using a delimiter that's less likely to appear in names (e.g., \x00 null byte), or using a fixed number of splits:
| const [hash, date, name] = commitMessage.split('|'); | |
| const parts = commitMessage.split('|'); | |
| const [hash, date] = parts; | |
| const name = parts.slice(2, -1).join('|'); |
This takes the email (last field) off the end and joins the remaining middle fields back, preserving any | in the author name.
Prompt To Fix With AI
This is a comment left during a code review.
Path: scripts/release-notes/gen-data.mjs
Line: 96
Comment:
**Pipe delimiter can split author names incorrectly**
The format string on line 78 is `%h|%ai|%aN|%ae`, producing 4 pipe-delimited fields. The destructuring here only captures 3 values (`hash`, `date`, `name`), which works in the common case. However, if an author's Git display name (`%aN`) contains a `|` character, `split('|')` would produce more than 4 segments, and `name` would be truncated to only the portion before the first `|` in the name.
Consider using a delimiter that's less likely to appear in names (e.g., `\x00` null byte), or using a fixed number of splits:
```suggestion
const parts = commitMessage.split('|');
const [hash, date] = parts;
const name = parts.slice(2, -1).join('|');
```
This takes the email (last field) off the end and joins the remaining middle fields back, preserving any `|` in the author name.
How can I resolve this? If you propose a fix, please make it concise.2 participants
Mirror of facebook/react#35949
Original author: jackpope
Add an interactive release notes app (scripts/release-notes/) for triaging commits and generating markdown.
Run
yarn gen-data -v <version>to pull commits since a tag, thenyarn devto launch a Vite app where you can mark commits to include, tag and group them, filter the list, and get a live markdown preview. Triage state persists to a local JSON file.This is good for a first pass on what to include. Then you can copy the markdown out to reword messages and do additional custom grouping or formatting changes.