fix(wasm): harden marimo inline Graphviz rendering for srcdoc and UTF-8 DOT

Author: pablormier

corneto/contrib/_util.py

@@ -92,6 +92,19 @@ def dot_wasm_html(
     <script type="module">
     (async () => {{
       const target = document.getElementById("{container_id}");
+      const setTargetHtml = (markup) => {{
+        if (target) {{
+          target.innerHTML = markup;
+        }}
+      }};
+      if (!target) {{
+        return;
+      }}
+      const decodeBase64Utf8 = (encoded) => {{
+        const binary = atob(encoded);
+        const bytes = Uint8Array.from(binary, (char) => char.charCodeAt(0));
+        return new TextDecoder("utf-8").decode(bytes);
+      }};
       const resizeFrameToContent = () => {{
         try {{
           let h = target ? target.scrollHeight : 0;
@@ -107,7 +120,7 @@ def dot_wasm_html(
             window.frameElement.style.height = `${{h}}px`;
           }}
         }} catch (_err) {{
-          // best effort only
+          /* best effort only */
         }}
       }};
       try {{
@@ -117,15 +130,15 @@ def dot_wasm_html(
           throw new Error("Graphviz WASM module does not expose Graphviz.load()");
         }}
         const graphviz = await Graphviz.load();
-        const dot = atob("{dot_string_base64}");
+        const dot = decodeBase64Utf8("{dot_string_base64}");
         const svg = await graphviz.dot(dot, "svg", "dot");
-        target.innerHTML = svg;
+        setTargetHtml(svg);
         resizeFrameToContent();
         requestAnimationFrame(resizeFrameToContent);
         setTimeout(resizeFrameToContent, 50);
       }} catch (error) {{
-        target.innerHTML = "<pre style='white-space:pre-wrap;color:#b00020'>Graph rendering failed: " +
-          String(error) + "</pre>";
+        setTargetHtml("<pre style='white-space:pre-wrap;color:#b00020'>Graph rendering failed: " +
+          String(error) + "</pre>");
         resizeFrameToContent();
       }}
     }})();

tests/graph/test_plotting.py

@@ -42,6 +42,24 @@ def test_dot_wasm_html_accepts_raw_dot_source():
     assert "Graphviz.load" in html
 
 
+def test_dot_wasm_html_avoids_line_comments_in_inline_script():
+    html = dot_wasm_html('digraph {"A" -> "B";}')
+    assert "// best effort only" not in html
+    assert "/* best effort only */" in html
+
+
+def test_dot_wasm_html_guards_missing_target_element():
+    html = dot_wasm_html('digraph {"A" -> "B";}')
+    assert "if (!target) {" in html
+    assert "setTargetHtml" in html
+
+
+def test_dot_wasm_html_decodes_dot_as_utf8():
+    html = dot_wasm_html('digraph {"á" -> "ß";}')
+    assert 'new TextDecoder("utf-8").decode(bytes)' in html
+    assert "decodeBase64Utf8" in html
+
+
 def test_plot_wasm_works_without_graphviz(monkeypatch):
     g = Graph()
     g.add_edge("A", "B")