Repository navigation
Escape image titles and alt text in Markdown - #493
Conversation
A double quote in an image's title or alt text ended the HTML attribute early, so the title was cut short and the rest of the text leaked into the tag's markup. Escape the URL, title and alt text before they go into the link and image tags.
|
🤖 @codex review. Don't run the tests. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
The test does not exercise the newly added URL escaping behavior.
Review effort: Balanced
Findings: 1
Open (1)
What changed in this PR
Escapes Markdown image attributes to prevent malformed or injected HTML.
Changes:
- Escapes image URLs, titles, and alt text.
- Adds regression coverage for title and alt-text injection.
[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or rungh pr ready --undo.
Click "Ready for review" or rungh pr readyto reengage.
| File | Description |
|---|---|
lib/markdown_renderer.rb |
Escapes values before HTML interpolation. |
test/lib/markdown_renderer_test.rb |
Tests image attribute escaping. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8b4aac7b27
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
🤖 @codex review. Don't run the tests. |
|
Codex Review: Didn't find any major issues. Hooray! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
A double quote in an image's title or alt text ended the HTML attribute
early, so the title was cut short and the rest of the text leaked into
the tag's markup. Escape the URL, title and alt text before they go into
the link and image tags.