From 77ac1174742759233fd37a3575573929243119cd Mon Sep 17 00:00:00 2001 From: Mrugesh Mohapatra Date: Fri, 11 Sep 2026 15:40:56 +0530 Subject: [PATCH 1/6] fix(hint): escape output instead of parsing HTML --- src/config/swagger.ts | 4 +- src/lib/__tests__/formatHintOutput.test.ts | 90 +++++++++++++++++++++- src/lib/formatHintOutput.ts | 58 ++++++++++---- 3 files changed, 136 insertions(+), 16 deletions(-) diff --git a/src/config/swagger.ts b/src/config/swagger.ts index 667cc9f..228bb75 100644 --- a/src/config/swagger.ts +++ b/src/config/swagger.ts @@ -1,4 +1,5 @@ import { SERVER_URL } from './env'; +import { MAX_HINT_RESPONSE_CHARS } from '../lib/formatHintOutput'; const swaggerDefinition: Record = { openapi: '3.0.0', @@ -160,8 +161,9 @@ export const sharedSchemas = [ properties: { hint: { type: 'string', + maxLength: MAX_HINT_RESPONSE_CHARS, description: - 'The AI-generated hint. Only elements without attributes are active HTML; all other tags are encoded as text.', + 'The AI-generated hint. Only elements without attributes are active HTML. All other tags are encoded as text. Insert this value into an element. Do not insert it into an HTML attribute, because quotes are not encoded.', example: 'Check whether your sum function returns a value.', }, model_used: { diff --git a/src/lib/__tests__/formatHintOutput.test.ts b/src/lib/__tests__/formatHintOutput.test.ts index 6f72347..bcacafe 100644 --- a/src/lib/__tests__/formatHintOutput.test.ts +++ b/src/lib/__tests__/formatHintOutput.test.ts @@ -1,5 +1,9 @@ import { describe, expect, it } from 'vitest'; -import { formatHintOutput, MAX_HINT_CODE_POINTS } from '../formatHintOutput'; +import { + formatHintOutput, + MAX_HINT_CODE_POINTS, + MAX_HINT_RESPONSE_CHARS, +} from '../formatHintOutput'; describe('formatHintOutput', () => { it('preserves attribute-free code elements', () => { @@ -59,4 +63,88 @@ describe('formatHintOutput', () => { it('returns an empty string for empty input', () => { expect(formatHintOutput(' ')).toBe(''); }); + + it('keeps attributes readable as text on escaped elements', () => { + expect(formatHintOutput('Your is missing alt text.')).toBe( + 'Your <img src="cat.jpg"> is missing alt text.', + ); + }); + + it('keeps attributes readable as text inside code elements', () => { + expect(formatHintOutput('Use .')).toBe( + 'Use <meta charset="utf-8">.', + ); + }); + + it('does not let raw-text elements swallow the closing code tag', () => { + expect(formatHintOutput('Wrap it in