fix: markdown html link render error #4119
Conversation
|
Warning Rate limit exceeded@Ricbet has exceeded the limit for the number of commits or files that can be reviewed per hour. Please wait 20 minutes and 54 seconds before requesting another review. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. Walkthrough此次更改涉及三个主要文件，分别是 Changes
Possibly related PRs
Suggested reviewers
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
There was a problem hiding this comment.
Actionable comments posted: 3
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
📒 Files selected for processing (3)
- packages/ai-native/src/browser/components/ChatMarkdown.tsx (0 hunks)
- packages/components/src/markdown-react/parse.tsx (3 hunks)
- packages/components/src/markdown-react/render.tsx (3 hunks)
💤 Files with no reviewable changes (1)
- packages/ai-native/src/browser/components/ChatMarkdown.tsx
🧰 Additional context used
🪛 Biome
packages/components/src/markdown-react/render.tsx
[error] 132-132: Avoid passing content using the dangerouslySetInnerHTML prop.
Setting content using code can expose users to cross-site scripting (XSS) attacks
(lint/security/noDangerouslySetInnerHtml)
🔇 Additional comments (2)
packages/components/src/markdown-react/parse.tsx (2)
22-22: 改进：HTML 渲染方式更安全将 HTML 渲染委托给 renderer.html 处理是一个很好的改进，这样可以避免直接使用 dangerouslySetInnerHTML，提高了安全性。
122-123: 验证：HTML 实体替换的正则表达式正则表达式
/&(#\d+|[a-zA-Z]+);/g看起来能够正确匹配 HTML 实体，但建议验证一下是否能处理所有边缘情况。✅ Verification successful
Let me analyze the results and generate additional verification to check the implementation details.
HTML 实体替换实现已验证完备
代码中的正则表达式
/&(#\d+|[a-zA-Z]+);/g配合unescapeInfoMap 的实现已经完全覆盖了常见的 HTML 实体转换场景：
- 支持数字实体（如
'）- 支持命名实体（如
"、 、&、<、>）- 对于未知实体会保持原样（通过
?? m实现）实现方案简洁且健壮，无需修改。
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # 搜索代码库中的 HTML 实体使用情况，确保所有情况都能被正确处理 rg -g '*.{md,mdx,html,tsx,jsx}' '&(#\d+|[a-zA-Z]+);' -A 2Length of output: 1269
Script:
#!/bin/bash # Check the implementation of unescapeInfo and related code ast-grep --pattern 'class $_ { $$$ unescapeInfo$_$$$ $$$ }'Length of output: 67
Script:
#!/bin/bash # 检查 parse.tsx 文件中的 unescapeInfo 相关实现 cat packages/components/src/markdown-react/parse.tsxLength of output: 4754
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #4119 +/- ##
==========================================
+ Coverage 54.26% 54.29% +0.03%
==========================================
Files 1598 1597 -1
Lines 97564 97498 -66
Branches 19946 19937 -9
==========================================
- Hits 52941 52935 -6
+ Misses 37074 37020 -54
+ Partials 7549 7543 -6
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
📒 Files selected for processing (1)
- packages/components/src/markdown-react/render.tsx (3 hunks)
🧰 Additional context used
🪛 Biome
packages/components/src/markdown-react/render.tsx
[error] 132-132: Avoid passing content using the dangerouslySetInnerHTML prop.
Setting content using code can expose users to cross-site scripting (XSS) attacks
(lint/security/noDangerouslySetInnerHtml)
🔇 Additional comments (1)
packages/components/src/markdown-react/render.tsx (1)
131-132: HTML 内容需要安全处理之前的评审意见关于使用 DOMPurify 进行 HTML 内容净化的建议仍然有效。直接使用
dangerouslySetInnerHTML存在 XSS 安全风险。🧰 Tools
🪛 Biome
[error] 132-132: Avoid passing content using the dangerouslySetInnerHTML prop.
Setting content using code can expose users to cross-site scripting (XSS) attacks
(lint/security/noDangerouslySetInnerHtml)
Types
Background or solution
Changelog
修复 markdown react 组件渲染 html 标签异常的问题
Summary by CodeRabbit
新特性
Bug修复
文档