From c200a4d777c04f3f9a745728d8fc02a7219de274 Mon Sep 17 00:00:00 2001 From: Andrey Antukh Date: Wed, 19 Aug 2026 18:21:55 +0200 Subject: [PATCH] :bug: Fix HTML escaping in notification pill detail section (#11275) The notification pill component now properly respects the `is-html` flag when rendering the detail section, matching the behavior of the children section. Token import error messages now escape HTML characters in user-provided values like token names and type names before displaying them in notifications. AI-assisted-by: qwen3.7-plus --- frontend/src/app/main/data/workspace/tokens/errors.cljs | 5 +++-- .../src/app/main/data/workspace/tokens/import_export.cljs | 6 ++++-- .../main/ui/ds/notifications/shared/notification_pill.cljs | 6 ++++-- 3 files changed, 11 insertions(+), 6 deletions(-) diff --git a/frontend/src/app/main/data/workspace/tokens/errors.cljs b/frontend/src/app/main/data/workspace/tokens/errors.cljs index e5716f07be..8ca54af835 100644 --- a/frontend/src/app/main/data/workspace/tokens/errors.cljs +++ b/frontend/src/app/main/data/workspace/tokens/errors.cljs @@ -6,6 +6,7 @@ (ns app.main.data.workspace.tokens.errors (:require + [app.util.dom :as dom] [app.util.i18n :refer [tr]] [cuerdas.core :as str])) @@ -25,12 +26,12 @@ :error.import/invalid-token-name {:error/code :error.import/invalid-token-name :error/fn #(tr "errors.tokens.invalid-json-token-name") - :error/detail #(tr "errors.tokens.invalid-json-token-name-detail" %)} + :error/detail #(tr "errors.tokens.invalid-json-token-name-detail" (dom/escape-html %))} :error.import/style-dictionary-reference-errors {:error/code :error.import/style-dictionary-reference-errors :error/fn #(str (tr "errors.tokens.import-error") "\n\n" (first %)) - :error/detail #(str/join "\n\n" (rest %))} + :error/detail #(str/join "\n\n" (map dom/escape-html (rest %)))} :error.import/style-dictionary-unknown-error {:error/code :error.import/style-dictionary-reference-errors diff --git a/frontend/src/app/main/data/workspace/tokens/import_export.cljs b/frontend/src/app/main/data/workspace/tokens/import_export.cljs index 5dded5bbb3..5c7c9151b7 100644 --- a/frontend/src/app/main/data/workspace/tokens/import_export.cljs +++ b/frontend/src/app/main/data/workspace/tokens/import_export.cljs @@ -16,6 +16,7 @@ [app.main.data.tokenscript :as ts] [app.main.data.workspace.tokens.errors :as wte] [app.main.store :as st] + [app.util.dom :as dom] [app.util.i18n :as i18n] [beicon.v2.core :as rx] [cuerdas.core :as str])) @@ -54,14 +55,15 @@ (l/wrn :hint "unsupported token types found during import" :tokens (str/join ", " (map (fn [[path type]] (str path " (" type ")")) unknown-tokens))) (ntf/show {:content (i18n/tr "workspace.tokens.unknown-token-type-message") + :is-html true :detail (->> (for [[token-type token-paths] type->tokens] (str (i18n/tr "workspace.tokens.unknown-token-type-section" - token-type + (dom/escape-html token-type) (i18n/tr "labels.warning-count" (i18n/c (count token-paths)))) "")) (str/join "")) diff --git a/frontend/src/app/main/ui/ds/notifications/shared/notification_pill.cljs b/frontend/src/app/main/ui/ds/notifications/shared/notification_pill.cljs index 0a774f33ac..c14696c988 100644 --- a/frontend/src/app/main/ui/ds/notifications/shared/notification_pill.cljs +++ b/frontend/src/app/main/ui/ds/notifications/shared/notification_pill.cljs @@ -59,5 +59,7 @@ (when detail [:details {:class (stl/css :error-detail)} [:summary {:class (stl/css :error-detail-summary)} (tr "workspace.notification-pill.detail")] - [:div {:class (stl/css :error-detail-content) - :dangerouslySetInnerHTML #js {:__html detail}}]])])) + (if is-html + [:div {:class (stl/css :error-detail-content) + :dangerouslySetInnerHTML #js {:__html detail}}] + [:div {:class (stl/css :error-detail-content)} detail])])]))