sfirke opened a new pull request, #43722:
URL: https://github.com/apache/superset/pull/43722
### SUMMARY
Fixes #43721.
The Handlebars chart joins the template and the CSS Styles block with a
single newline:
```ts
const templateSource = `${handlebarTemplateSource}\n${styleTemplateSource} `;
```
That output is rendered as Markdown by `SafeMarkdown`. When the template
opens with a block-level HTML tag (`<table>`, `<div>`, `<ul>`, …), that tag
starts a [CommonMark HTML block type
6](https://spec.commonmark.org/0.31.2/#html-blocks), which ends at the first
blank line. Without a blank line before `<style>`, the tag is absorbed into
that still-open block instead of starting its own **HTML block type 1**
(`<script>`/`<pre>`/`<style>`/`<textarea>`) — the one block type that ignores
blank lines and runs until a literal `</style>`.
The first blank line inside the CSS therefore closes the HTML block, and
every rule after it is parsed as an ordinary Markdown paragraph and rendered as
visible `<p>` text in the chart.
Two ingredients are needed, which is probably why this went unnoticed: the
template must begin with a block-level HTML tag (plain-text templates work,
because `<style>` correctly interrupts a paragraph), and the CSS must contain a
blank line (single-rule or tightly-packed CSS works). Normal, readable CSS in a
realistic template hits both.
This happens in `remark-parse`, before `rehype-raw` and `rehype-sanitize`
run, so it is not a sanitization problem and
`HTML_SANITIZATION_SCHEMA_EXTENSIONS` cannot work around it. The Markdown
parsing is spec-correct; the missing blank line in the concatenation is the bug.
Using `\n\n` lets `<style>` open its own HTML block. Verified against the
pinned pipeline (`[email protected]`, `[email protected]`,
`[email protected]`, `[email protected]`, `[email protected]`) with CSS
containing leading, trailing and interior blank lines, with no CSS, and with a
plain-text template; Markdown in the template (headings, lists, emphasis) still
renders normally.
### TESTING INSTRUCTIONS
Added `test/Handlebars.test.tsx`, which asserts the blank-line separator,
the `{{data}}` fallback, and that no `<style>` block is emitted when no styles
are set. The first two tests fail without this change.
Manually:
1. Create a Handlebars chart.
2. Handlebars Template:
```html
<table>
<tr><td>a</td></tr>
</table>
```
3. CSS Styles:
```css
td { color: red; }
th { color: blue; }
```
4. Before: `th { color: blue; }` renders as visible text. After: both rules
apply and nothing leaks.
Note: the plugin's Jest suite needs the workspace packages built (`lib/`)
for the frontend type-check hook to pass locally; the type-check failure on
`test/**` files without a build is pre-existing and reproduces on untouched
test files.
### ADDITIONAL INFORMATION
- [x] Has associated issue: #43721
- [ ] Required feature flags:
- [x] Changes UI
- [ ] Includes DB Migration (follow approval process in
[SIP-59](https://github.com/apache/superset/issues/13351))
- [ ] Migration is atomic, supports rollback & is backwards-compatible
- [ ] Confirm DB migration upgrade and downgrade tested
- [ ] Runtime estimates and downtime expectations provided
- [ ] Introduces new feature or API
- [ ] Removes existing feature or API
Likely also the underlying cause of #30381, which attributes the same
symptom to `HTML_SANITIZATION_SCHEMA_EXTENSIONS` not being read.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
https://claude.ai/code/session_01WLbn2t4AdJvjfiT9xo64bk
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
