fix: decode HTML entities in anchor modal title#544
Conversation
The modal heading extracted the <h1> text via regex from rendered HTML (which contains &) and set it as textContent, so anchors like "Plain English according to Strunk & White" showed the literal "&". Parse via DOMParser instead so the browser decodes entities; DOMParser is parse-don't-execute (no XSS risk). The share-link title, which reads from #modal-title, is fixed by the same change. Adds a regression test that fails on the old regex path. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✅ Files skipped from review due to trivial changes (1)
WalkthroughDie Änderung aktualisiert die Titelextraktion für Ankermodals: statt Regex-Matching wird jetzt ein ÄnderungenAnkertitel-Entity-Handling
Geschätzter Aufwand für Code-Review🎯 2 (Einfach) | ⏱️ ~10 Minuten 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 ESLint
ESLint skipped: no ESLint configuration detected in root package.json. To enable, add Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@website/src/components/anchor-modal.js`:
- Line 245: ESLint reports "'DOMParser' is not defined" because new DOMParser()
is used in anchor-modal.js; fix by adding DOMParser: 'readonly' to the browser
globals object used by ESLint (the languageOptions.globals -> browserGlobals
entry in website/eslint.config.js) so the global is recognized, and if tests
also use DOMParser add it to the test globals as well.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: CHILL
Plan: Pro
Run ID: deeb97d9-5793-40f3-b574-37a4e1332740
📒 Files selected for processing (2)
website/src/components/anchor-modal.jswebsite/src/components/anchor-modal.test.js
The entity-decode fix uses DOMParser, which the explicit browser-globals allowlist did not include, causing a no-undef lint error. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Problem
Anchor modal headings showed literal HTML entities, e.g. "Plain English according to Strunk & White" instead of "Strunk & White". The same applied to any anchor with
&,<,>in its title (e.g. "Hexagonal Architecture (Ports & Adapters)").Root cause
loadAnchorContentextracted the<h1>text from the asciidoctor-rendered HTML with a regex, then assigned the captured string (which still contains&) viatextContent. Since the source HTML is already entity-encoded,textContentrendered the entity literally. The JSON/AsciiDoc source was always correct — only this render path double-handled entities, which is why the bug kept recurring.Fix
Parse the rendered HTML with
DOMParserand readh1.textContent, letting the browser decode entities.DOMParseris parse-don't-execute, so there is no XSS surface. The share-link title (read from#modal-title) is fixed by the same change.Test
Adds a regression test
should decode HTML entities in the modal title— verified red on the old regex path, green with the fix. All 16anchor-modaltests pass.🤖 Generated with Claude Code
Summary by CodeRabbit
Bug Fixes
Tests
Chores