Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

sidebar: possible issues with HTML rendering

See original GitHub issue

Is this an expected result?

I would think promnesia shouldn’t render any HTML it finds in the context, seems dangerous

Had a discord message which had a block of HTML in it as the context:

seems that it gets rendered/executed:

Probably want to escape HTML so that this doesn’t happen?

The text used, for reference:

curl 'https://myanimelist.net/profile/purplepinapples' -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:77.0) Gecko/20100101 Firefox/77.0' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8' -H 'Accept-Language: en-US,en;q=0.5' --compressed -H 'Referer: https://myanimelist.net/' -H 'Connection: keep-alive' -H 'Cookie: MALSESSIONID=MALHLOGSESSID=; m_gdpr_mdl_2=1; is_logged_in=1; anime_update_advanced=1; clubcomments=a%3A6%3A%7Bi%3A77624%3Bi%3A1588205393%3Bi%3A29693%3Bi%3A1588528890%3Bi%3A18421%3Bi%3A1588906736%3Bi%3A7367%3Bi%3A1588919526%3Bi%3A19736%3Bi%3A1588955723%3Bi%3A72940%3Bi%3A1589744327%3B%7D' -H 'Upgrade-Insecure-Requests: 1' -H 'Pragma: no-cache' -H 'Cache-Control: no-cache'
<html>
<head><title>403 Forbidden</title></head>
<body bgcolor="white">
<center><h1>403 Forbidden</h1></center>
</body>
</html>

Issue Analytics

State:
Created 2 years ago
Comments:9 (9 by maintainers)

Top GitHub Comments

1reaction

karlicosscommented, Apr 23, 2021

Yeah let’s keep it, I think there is some useful context

1reaction

karlicosscommented, Apr 19, 2021

Ah, sorry! I read ‘markdown’ and looked in the markdown source 🤦‍♂️ no, it doesn’t autodetect. So that means in the extension it would go via the ‘anchorme’ path https://github.com/karlicoss/promnesia/blob/0e1e9a1ccd1f07b2a64336c18c7f41ca24fcbcd4/extension/src/display.js#L163-L187 (to try to detect the URLs and make them clickable), and then it just sets HTML as is – so there is possibility for such artifacts… IIRC the problem that it’s tricky to keep the <a> tags, but also clean up everything else (ideally other tags shouldn’t seep through at all?). Not sure if there is some easy way to solve it, but would be nice… Ideally I guess it should simply be a sequence of <a> and <pre> tags or something like it?

And yeah – I think ideally sources returning markdown would add the HTML hint, didn’t have time to try it so far though – let me know if/how it works!