Page MenuHomePhabricator

Re-enable safe HTML for some error messages and metadata keys
Closed, ResolvedPublicBUG REPORT

Description

Description

Error messages are surfaced to the user in the following components:

  • FunctionMetadataDialog component
  • ZObjectStringRenderer component
  • FunctionInputParser component

Some of these are safe html fragments:

  • message "wikilambda-visualeditor-wikifunctionscall-error-parser"
  • message "wikilambda-renderer-unknown-error"
  • error string arguments list
  • child error type list

We should only add as v-html those strings that we know are safe HTML fragments, and insert as text all the rest.


Completion checklist

Event Timeline

Change #1187882 had a related patch set uploaded (by Genoveva Galarza; author: Genoveva Galarza):

[mediawiki/extensions/WikiLambda@master] [WIP] Re-enable controlled and safe html for error messages and metadata

https://gerrit.wikimedia.org/r/1187882

Change #1187882 merged by jenkins-bot:

[mediawiki/extensions/WikiLambda@master] Re-enable controlled and safe html for error messages and metadata

https://gerrit.wikimedia.org/r/1187882