Conversation
| return { | ||
| type: { | ||
| default: 'note', | ||
| parseHTML: (element) => element.getAttribute('data-admonition') ?? 'note', |
There was a problem hiding this comment.
💡 Security: AdmonitionNode type attribute is not validated on parse
In AdmonitionNode.ts, the parseHTML handler reads data-admonition from the DOM element without validating it against the known admonition types (line 25). Since this attribute value is interpolated into a CSS class name (admonition-${node.attrs.type}) in renderHTML (line 41), a crafted document could inject arbitrary class names (e.g., data-admonition="foo bar" → class="admonition admonition-foo bar"). Consider validating the attribute against the allowed types set.
Suggested fix:
const VALID_TYPES = new Set(['note', 'warning', 'danger', 'info', 'tip', 'caution']);
parseHTML: (element) => {
const type = element.getAttribute('data-admonition') ?? 'note';
return VALID_TYPES.has(type) ? type : 'note';
},
Was this helpful? React with 👍 / 👎 | Reply gitar fix to apply this suggestion
🟡 Playwright Results — all passed (18 flaky)✅ 3955 passed · ❌ 0 failed · 🟡 18 flaky · ⏭️ 86 skipped
🟡 18 flaky test(s) (passed on retry)
How to debug locally# Download playwright-test-results-<shard> artifact and unzip
npx playwright show-trace path/to/trace.zip # view trace |
Code Review 👍 Approved with suggestions 4 resolved / 5 findingsServiceDoc panel now supports admonitions and a code copy button, resolving issues with redundant type sets, improper content rendering, and memory leaks. Ensure the AdmonitionNode type attribute is validated during parsing to prevent malformed node injection. 💡 Security: AdmonitionNode type attribute is not validated on parse📄 openmetadata-ui/src/main/resources/ui/src/components/BlockEditor/Extensions/AdmonitionNode.ts:25 📄 openmetadata-ui/src/main/resources/ui/src/components/BlockEditor/Extensions/AdmonitionNode.ts:41 In Suggested fix✅ 4 resolved✅ Bug: Admonition content is double-converted through markdown-to-HTML
✅ Bug: contentRef will always be null — NodeViewContent doesn't forward refs
✅ Edge Case: setTimeout in handleCopy not cleared on unmount
✅ Quality: ADMONITION_TYPES set is redundant — regex already constrains values
🤖 Prompt for agentsOptionsDisplay: compact → Showing less information. Comment with these commands to change:
Was this helpful? React with 👍 / 👎 | Gitar |
|



Describe your changes:
Fixes #27705
I worked on ... because ...
Type of change:
Checklist:
Fixes <issue-number>: <short explanation>Summary by Gitar
AdmonitionNodesupport with visual styles fornote,warning,danger,info,tip, andcaution.CodeBlockWithCopyusingCodeBlockComponentto provide a copy-to-clipboard feature inServiceDocPanel.ServiceUtils.tsxto includeconvertAdmonitionsToHtmlfor processing markdown-based admonition syntax.This will update automatically on new commits.