Ensure <li>s are wrapped in a <ol> or <ul> after sanitizing HTML

[diox]

Fixes mozilla/addons#14989

Context

This matters when displaying the versions page, where each version is in a <li> already, and developers can have release notes containing <li> of their own. This can be seen:

• On dev: https://addons-dev.allizom.org/en-US/firefox/addon/ratopuse-weasp-vulturkal/versions/
• On prod: https://addons.mozilla.org/en-US/firefox/addon/bitwarden-password-manager/versions/

(Look at the output carefully, the HTML from the footer is duplicated, the "clone" appearing either in the sidebar or on top of the existing footer)

Testing

You have to manually craft HTML with <li> and no parent <ul> and get it passed to our sanitize functions to test this. That is harder to achieve now that we have markdown, so best to modify the entry in the database, or pick one that was already broken, or test with https://localhost:3000/en-US/firefox/addon/ratopuse-weasp-vulturkal/versions/ with the patch applied and unapplied to see the difference. Or look at the unit tests.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 98.29%. Comparing base (8173acd) to head (f196bb9).
Report is 6 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master   #13544   +/-   ##
=======================================
  Coverage   98.28%   98.29%           
=======================================
  Files         267      268    +1     
  Lines       10630    10647   +17     
  Branches     3247     3258   +11     
=======================================
+ Hits        10448    10465   +17     
  Misses        169      169           
  Partials       13       13           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[eviljeff]

Can we have tests for multiple <li> and when the closing </li> is missing?

[diox]

f196bb9 ; I added handling of multiple <li> close together while I was at it

[willdurand]

That is harder to achieve now that we have markdown

Couldn't we fix the DB instead then? That kind of hook applied on everything we sanitize feels risky to me.

[diox]

Couldn't we fix the DB instead then? That kind of hook applied on everything we sanitize feels risky to me.

We could fix it for current content and hope it doesn't come back but we don't have a strong guarantee.

My reasoning was, why wouldn't we want that applied to everything we sanitize ? This is invalid HTML, you have to have a ul, ol or menu as parent of a <li> per the spec so leaving the possibility of not having one of those as the parent is asking for trouble...

[diox]

I spent a bit more time investigating what a migration would look like and I still think this is the safer approach. I'm checking whether li and ul are in the allowed tags, so it should only really affect the specific places that we care about, and it's a lot easier to reverse if things go wrong than a data migration affecting a thousand strings.