Conversation
`transformStyledText` handed `styledText.text` to `dangerouslySetInnerHTML` after replacing newlines with `<br />`, so any markup in the document text reached the exported email verbatim: `<script>alert(1)</script>` stayed a live element, and ordinary text such as `x < 10 & y > 20` was swallowed by the email client's HTML parser. Split on the newline instead and render the lines as React children with `<br />` between them. React escapes text children, so the newline handling no longer requires the raw-HTML escape hatch. The snapshot updates are serialization-only: `<br />` -> `<br/>` and `'` -> `'`, both of which render identically. Fixes TypeCellOS#3072 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
@adarshsm is attempting to deploy a commit to the TypeCell Team on Vercel. A member of the Team first needs to authorize it. |
Contributor
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: trueThanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
@blocknote/ariakit
@blocknote/code-block
@blocknote/core
@blocknote/diagram-block
@blocknote/mantine
@blocknote/math-block
@blocknote/react
@blocknote/server-util
@blocknote/shadcn
@blocknote/xl-ai
@blocknote/xl-docx-exporter
@blocknote/xl-email-exporter
@blocknote/xl-multi-column
@blocknote/xl-odt-exporter
@blocknote/xl-pdf-exporter
@blocknote/xl-typst-exporter
commit: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #3072
The bug
ReactEmailExporter.transformStyledTextpassed the document's text straight intodangerouslySetInnerHTML:The
replacecall is only there to turn newlines into line breaks, but usingdangerouslySetInnerHTMLto do it means every other character in the text is interpreted as markup too. Two consequences:<script>alert(1)</script>emits that as a live element in the email, not as text. Any application that mails out user-authored BlockNote documents forwards whatever markup the author typed.x < 10 & y > 20,array[i < 5], or<CustomComponent>in a documentation snippet get parsed as tags by the email client and disappear or break the layout.Added as a failing test against
mainfirst — the exported HTML contained<script>verbatim:The fix
Split on the newline and render the lines as React children with
<br />between them, so the raw-HTML escape hatch is no longer needed at all and React escapes the text:I preferred this over adding an
escapeHtmlhelper in front of the existingdangerouslySetInnerHTML(as the issue suggests): the escape hatch is what makes this class of bug possible, and dropping it removes the need for a hand-maintained escaping table.I checked the other
dangerouslySetInnerHTMLcall sites inpackages/. Themath-blockones render KaTeX-produced MathML and thexl-odt-exporterones inject a developer-supplied header/footer, so neither is the same "document text treated as markup" case. This was the only one.Notes on the snapshot churn
Four existing snapshots move. Both changes are serialization-only and render identically:
<br />→<br/>— React's void-element output instead of the hand-written string.'→'in the inline-code textvar foo = 'bar';— React escaping the apostrophe.I diffed the old and new snapshots character by character to confirm nothing else moved.
Testing
vp linton the package reports no new findings for the changed files (the 26 pre-existing errors are all indefaultSchema/blocks.tsxand untouched here). I did not run the e2e suite, since it needs the Docker runner.🤖 Generated with Claude Code