github/penpot
1
0
Fork 0
mirror of https://github.com/penpot/penpot.git synced 2026-08-22 12:49:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

🐛 Fix HTML escaping in notification pill detail section (#11275)

Browse Source 
The notification pill component now properly respects the `is-html`
flag when rendering the detail section, matching the behavior of the
children section. Token import error messages now escape HTML
characters in user-provided values like token names and type names
before displaying them in notifications.

AI-assisted-by: qwen3.7-plus
This commit is contained in:
Andrey Antukh 2026-08-19 18:21:55 +02:00 committed by GitHub
parent a91c796b0e
commit c200a4d777
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 11 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
frontend/src/app/main/data/workspace/tokens/errors.cljs
View File

@ -6,6 +6,7 @@
(ns app.main.data.workspace.tokens.errors
(:require
[app.util.dom :as dom]
[app.util.i18n :refer [tr]]
[cuerdas.core :as str]))
@ -25,12 +26,12 @@
:error.import/invalid-token-name
{:error/code :error.import/invalid-token-name
:error/fn #(tr "errors.tokens.invalid-json-token-name")
:error/detail #(tr "errors.tokens.invalid-json-token-name-detail" %)}
:error/detail #(tr "errors.tokens.invalid-json-token-name-detail" (dom/escape-html %))}
:error.import/style-dictionary-reference-errors
{:error/code :error.import/style-dictionary-reference-errors
:error/fn #(str (tr "errors.tokens.import-error") "\n\n" (first %))
:error/detail #(str/join "\n\n" (rest %))}
:error/detail #(str/join "\n\n" (map dom/escape-html (rest %)))}
:error.import/style-dictionary-unknown-error
{:error/code :error.import/style-dictionary-reference-errors

6
frontend/src/app/main/data/workspace/tokens/import_export.cljs
View File

@ -16,6 +16,7 @@
[app.main.data.tokenscript :as ts]
[app.main.data.workspace.tokens.errors :as wte]
[app.main.store :as st]
[app.util.dom :as dom]
[app.util.i18n :as i18n]
[beicon.v2.core :as rx]
[cuerdas.core :as str]))
@ -54,14 +55,15 @@
(l/wrn :hint "unsupported token types found during import"
:tokens (str/join ", " (map (fn [[path type]] (str path " (" type ")")) unknown-tokens)))
(ntf/show {:content (i18n/tr "workspace.tokens.unknown-token-type-message")
:is-html true
:detail (->> (for [[token-type token-paths] type->tokens]
(str (i18n/tr "workspace.tokens.unknown-token-type-section"
token-type
(dom/escape-html token-type)
(i18n/tr "labels.warning-count" (i18n/c (count token-paths))))
"<ul>"
(->> token-paths
(sort)
(map #(str "<li>" % "</li>"))
(map #(str "<li>" (dom/escape-html %) "</li>"))
(str/join ""))
"</ul>"))
(str/join ""))

6
frontend/src/app/main/ui/ds/notifications/shared/notification_pill.cljs
View File

@ -59,5 +59,7 @@
(when detail
[:details {:class (stl/css :error-detail)}
[:summary {:class (stl/css :error-detail-summary)} (tr "workspace.notification-pill.detail")]
[:div {:class (stl/css :error-detail-content)
:dangerouslySetInnerHTML #js {:__html detail}}]])]))
(if is-html
[:div {:class (stl/css :error-detail-content)
:dangerouslySetInnerHTML #js {:__html detail}}]
[:div {:class (stl/css :error-detail-content)} detail])])]))