Skip to content

fix(integrations): Improper code sanitization #14201

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

ptrgits
Copy link

@ptrgits ptrgits commented Aug 8, 2025

fix the problem, we need to ensure that any potentially dangerous characters in the stringified headings are properly escaped before embedding them in the generated JavaScript code. The best way to do this is to escape characters such as <, >, /, \, and certain Unicode line/paragraph separators, as well as control characters, in the output of JSON.stringify(headings). This can be achieved by defining an escapeUnsafeChars function (as in the example) and applying it to the stringified headings before constructing the export statement. The change should be made in packages/integrations/mdx/src/rehype-collect-headings.ts, specifically on line 8, and the function should be defined in the same file or imported if already available.

Copy link

changeset-bot bot commented Aug 8, 2025

⚠️ No Changeset found

Latest commit: 5daf867

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@github-actions github-actions bot added the pkg: integration Related to any renderer integration (scope) label Aug 8, 2025
@ematipico
Copy link
Member

ematipico commented Aug 8, 2025

Thank you @ptrgits for the PR. Here's a few things to address for your first contribution:

  • please restore the template provided by the PR and fill all the relevant sections
  • please tell us if this PR fixes an existing issue or not
  • please add some tests that show the PR fixed some cases
  • please add a changeset

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
pkg: integration Related to any renderer integration (scope)
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants