-
Notifications
You must be signed in to change notification settings - Fork 2k
Sanitize upstream titles in release-readiness tracker tables (embedded newlines + unescaped pipes) #36031
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Sanitize upstream titles in release-readiness tracker tables (embedded newlines + unescaped pipes) #36031
Changes from 1 commit
eb765c0
03946d0
f07e143
0b7f755
769d79b
4f7d879
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -2842,7 +2842,10 @@ function Format-CiScanIssueRows { | |
| } | ||
| } | ||
| $issLink = "[#$($iss.number)]($RepoUrl/issues/$($iss.number))" | ||
| $title = ($iss.title -replace '\|', '\|').Trim() | ||
| # Collapse embedded newlines first: a malformed upstream ci-scan title can | ||
| # contain a literal CR/LF (observed: #35957), which would otherwise split this | ||
| # markdown table row across physical lines and break the rendered table. | ||
| $title = ($iss.title -replace '[\r\n]+', ' ' -replace '\|', '\|').Trim() | ||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 💡 💡 Suggestion (non-blocking): The newline collapse here looks correct, but the SR tracker still handles markdown-cell escaping ad hoc. Gemini's angle-bracket point is valid as a consistency/content-fidelity concern (
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 💡 💡 Suggestion (non-blocking, pre-existing scope). The newline collapse on this line is correct and well-targeted for the observed ci-scan bug. Two consistency gaps remain between the SR title-cell escaping here and the Preview engine's shared
Net: the PR is fine as-is for the observed bug. The “only cell fed unsanitized upstream titles” wording in the description slightly understates the existing surface, and a future |
||
| [void]$sb.AppendLine("| $marker$issLink | $title | $ageDisplay |") | ||
| } | ||
| if ($Issues.Count -gt $MaxRows) { | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -2263,6 +2263,21 @@ Assert-Eq -Label "Age column shows 'Nd ago' for older issues" -Expected $true ` | |
| Assert-Eq -Label "Format-CiScanIssueRows returns null for empty input" -Expected $true ` | ||
| -Actual ($null -eq (Format-CiScanIssueRows -Issues @() -RepoUrl 'https://github.com/dotnet/maui')) | ||
|
|
||
| # Regression: a malformed upstream ci-scan title containing a literal newline | ||
| # (observed live: #35957) must NOT split the markdown table row across physical | ||
| # lines. The title cell is collapsed to a single line so the rendered table stays | ||
| # intact. On the pre-fix code the embedded LF pushed the title tail + age cell onto | ||
| # a second line that no longer contained the issue link. | ||
| $nlIssue = @([PSCustomObject]@{ number = 35957; url = 'https://github.com/dotnet/maui/issues/35957'; | ||
| title = "Recurring long title (maui-pr-uitest`n[Content truncated due to length]"; | ||
| createdAt = $nowUtc.AddDays(-3).ToString('o') }) | ||
| $nlRows = Format-CiScanIssueRows -Issues $nlIssue -RepoUrl 'https://github.com/dotnet/maui' | ||
| $nlRowLines = @($nlRows -split "`r?`n" | Where-Object { $_ -match '#35957' }) | ||
| Assert-Eq -Label "Newline ci-scan title: issue row is a single physical line" -Expected 1 ` | ||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 💡 💡 Minor (test clarity, non-blocking). This first assertion (
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 💡 💡 Minor (test clarity, non-blocking): I agree with Opus that the first new SR assertion (
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 💡 💡 Suggestion (Test clarity): As noted by Opus, the first assertion ( |
||
| -Actual $nlRowLines.Count | ||
| Assert-Eq -Label "Newline ci-scan title: title tail + age stay on that row" -Expected $true ` | ||
| -Actual ($nlRowLines.Count -eq 1 -and $nlRowLines[0] -match 'truncated due to length.*ago \|') | ||
|
|
||
| # Truncation behavior: > MaxRows | ||
| $manyIssues = 1..20 | ForEach-Object { | ||
| [PSCustomObject]@{ number = 40000 + $_; url = "https://github.com/dotnet/maui/issues/$(40000+$_)"; | ||
|
|
@@ -3178,6 +3193,17 @@ try { $null = Get-CategorizedPullRequests -TargetPRs $null -InflightPRs @($null, | |
| catch { $explicitNullThrew = $true } | ||
| Assert-Eq -Label "explicit null target + @(null, maestro) inflight → no throw" -Expected $false -Actual $explicitNullThrew | ||
|
|
||
| Write-Host "`n[Unit] Format-MarkdownCell collapses embedded newlines (table-row safety)" -ForegroundColor Cyan | ||
| # A malformed upstream title with a literal CR/LF (observed live: ci-scan issue | ||
| # #35957) must be collapsed to a single line so it cannot split the markdown table | ||
| # row in the rendered Preview tracker body. The existing pipe / angle-bracket | ||
| # escaping contract must remain intact. | ||
| Assert-Eq -Label "Format-MarkdownCell: LF collapsed to single space" -Expected 'a b' -Actual (Format-MarkdownCell "a`nb") | ||
| Assert-Eq -Label "Format-MarkdownCell: CRLF run collapsed to single space" -Expected 'a b' -Actual (Format-MarkdownCell "a`r`n`r`nb") | ||
| Assert-Eq -Label "Format-MarkdownCell: no CR/LF survives in the cell" -Expected $false -Actual ((Format-MarkdownCell "x`ny") -match "`r|`n") | ||
| Assert-Eq -Label "Format-MarkdownCell: pipe still escaped" -Expected 'a \| b' -Actual (Format-MarkdownCell 'a | b') | ||
| Assert-Eq -Label "Format-MarkdownCell: angle brackets still escaped" -Expected 'List<T>' -Actual (Format-MarkdownCell 'List<T>') | ||
|
|
||
| Write-Host "`n────────────────────────────────────────" -ForegroundColor Cyan | ||
| Write-Host "Passed: $script:passed Failed: $script:failed" -ForegroundColor $(if ($script:failed -eq 0) { 'Green' } else { 'Red' }) | ||
| exit $(if ($script:failed -eq 0) { 0 } else { 1 }) | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
💡 💡 Suggestion (non-blocking): Consider also escaping
<and>to<and>here to match the escaping done inGet-PreviewReadiness.ps1'sFormat-MarkdownCell. This would prevent HTML injection if a ci-scan issue title contains angle brackets (e.g.List<T>). As noted in the PR description, centralizing cell escaping is a planned follow-up, which would be the perfect time to address this and other pre-existing unescaped sites (like L3196, L3386, and L3439) that Opus identified.