Skip to content

Ensure <li>s are wrapped in a <ol> or <ul> after sanitizing HTML #13544

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Apr 24, 2025

Conversation

diox
Copy link
Member

@diox diox commented Apr 18, 2025

Fixes mozilla/addons#14989

Context

This matters when displaying the versions page, where each version is in a <li> already, and developers can have release notes containing <li> of their own. This can be seen:

(Look at the output carefully, the HTML from the footer is duplicated, the "clone" appearing either in the sidebar or on top of the existing footer)

Testing

You have to manually craft HTML with <li> and no parent <ul> and get it passed to our sanitize functions to test this. That is harder to achieve now that we have markdown, so best to modify the entry in the database, or pick one that was already broken, or test with https://localhost:3000/en-US/firefox/addon/ratopuse-weasp-vulturkal/versions/ with the patch applied and unapplied to see the difference. Or look at the unit tests.

This matters when displaying the versions page, where each version
is in a <li> already, and developers can have release notes
containing <li> of their own.
Copy link

codecov bot commented Apr 18, 2025

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 98.29%. Comparing base (8173acd) to head (f196bb9).
Report is 6 commits behind head on master.

Additional details and impacted files
@@           Coverage Diff           @@
##           master   #13544   +/-   ##
=======================================
  Coverage   98.28%   98.29%           
=======================================
  Files         267      268    +1     
  Lines       10630    10647   +17     
  Branches     3247     3258   +11     
=======================================
+ Hits        10448    10465   +17     
  Misses        169      169           
  Partials       13       13           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@diox diox requested review from a team and eviljeff and removed request for a team April 18, 2025 11:48
});
});

it('doesnt wrap `<li>` inside a `<ul>` if not necessary with menu', () => {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we have tests for multiple <li> and when the closing </li> is missing?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

f196bb9 ; I added handling of multiple <li> close together while I was at it

@willdurand
Copy link
Member

That is harder to achieve now that we have markdown

Couldn't we fix the DB instead then? That kind of hook applied on everything we sanitize feels risky to me.

@diox
Copy link
Member Author

diox commented Apr 22, 2025

Couldn't we fix the DB instead then? That kind of hook applied on everything we sanitize feels risky to me.

We could fix it for current content and hope it doesn't come back but we don't have a strong guarantee.

My reasoning was, why wouldn't we want that applied to everything we sanitize ? This is invalid HTML, you have to have a ul, ol or menu as parent of a <li> per the spec so leaving the possibility of not having one of those as the parent is asking for trouble...

@diox
Copy link
Member Author

diox commented Apr 23, 2025

I spent a bit more time investigating what a migration would look like and I still think this is the safer approach. I'm checking whether li and ul are in the allowed tags, so it should only really affect the specific places that we care about, and it's a lot easier to reverse if things go wrong than a data migration affecting a thousand strings.

@diox diox force-pushed the sanitize-html-li branch from dc0c709 to f196bb9 Compare April 24, 2025 10:05
@diox diox merged commit 16ed2d2 into mozilla:master Apr 24, 2025
11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[Bug]: Duplicate <footer> on AMO version-history page, with its white text mostly-invisible but superimposed with the actual page content
3 participants