Skip to content
This repository has been archived by the owner on Jul 9, 2018. It is now read-only.

Add a sanitize package #12

Closed

Conversation

adamsilverstein
Copy link
Member

These could use some unit tests.

Copy link
Member

@aduth aduth left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could also do for a README.md

* @return Sanitized text. False on failure.
*/
export function sanitizeText( text ) {
var _text = wp.utils.stripTags( text ),
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How should we handle this dependency? Ideally it'd be referenced by Node module, but at the very least we need to ensure that the corresponding script handle is enqueued whenever the sanitize package is used.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

oh, yea - good catch. i'll switch this to referencing as a node module

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this has been refactored and is now imported

*/
export function sanitizeText( text ) {
var _text = wp.utils.stripTags( text ),
textarea = document.createElement( 'textarea' );
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could we reuse a shared reference of a textarea element? Is there any overhead to creating a new element every time this is invoked?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm sure there is some overhead and I like that suggestion, would that possible get destroyed though in a SPA context?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Addressed in 4eb3d86


try {
textarea.innerHTML = _text;
_text = wp.utils.stripTags( textarea.value );
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A potential optimization to consider is bypassing this step if there are no encoded entities to convert.

See related: Automattic/wp-calypso#9725

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good suggestion, for now the code here exactly matches what we have in core.

/**
* Strip HTML tags.
*
* @param {string} text Text to have the HTML tags striped out of.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Typo: striped should be stripped

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

right, thanks.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in 6c93f80

*
* @return Sanitized text. False on failure.
*/
export function sanitizeText( text ) {
Copy link
Member

@nylen nylen Jul 24, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This needs a better name and description. sanitizeText - in what way, against what? convert HTML entities - into what?

If I read this correctly, I think the answers are "remove tags and encode HTML entities". I'm having a hard time thinking of a good function name, though. Maybe we should just create the encodeHTMLEntities building block first, and not worry about the combination of the two functions until we need it? This would also be more easily testable.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need the combined function to maintain existing functionality in PressThis. I'll try to improve the naming and descriptions here. The unit tests would also help make the usages clearer.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I updated the inline docs a bit to hopefully clear up how these functions work.

@nylen
Copy link
Member

nylen commented Jul 24, 2017

When are these functions expected to be used? In particular the combination of "strip tags and encode HTML entities" seems a bit strange to me.

omarreiss pushed a commit that referenced this pull request Aug 1, 2017
…ari-voiceover

Append a no-break space to repeated messages.
@ntwb
Copy link
Member

ntwb commented Aug 16, 2017

I've added a handful of basic tests for stripTags via 7e360f0

@codecov
Copy link

codecov bot commented Aug 16, 2017

Codecov Report

Merging #12 into master will decrease coverage by 12.06%.
The diff coverage is 30%.

Impacted file tree graph

@@             Coverage Diff             @@
##           master      #12       +/-   ##
===========================================
- Coverage     100%   87.93%   -12.07%     
===========================================
  Files           6        9        +3     
  Lines          48       58       +10     
  Branches        7       10        +3     
===========================================
+ Hits           48       51        +3     
- Misses          0        5        +5     
- Partials        0        2        +2
Impacted Files Coverage Δ
packages/sanitize/src/sanitizeText.js 0% <0%> (ø)
packages/sanitize/src/index.js 0% <0%> (ø)
packages/sanitize/src/stripTags.js 100% <100%> (ø)

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update d7c1b5e...6c93f80. Read the comment docs.

@adamsilverstein
Copy link
Member Author

When are these functions expected to be used? In particular the combination of "strip tags and encode HTML entities" seems a bit strange to me.
@nylen -
In WordPress core, the functions are used in wp-admin/js/press-this.js. sanitizeText is called in getTitleText to safely set the untrusted title text: $( '#post_title' ).val( getTitleText() );. stripTags is used in that function and also might be generally useful: it uses regexs to strip tags from content.

@notnownikki
Copy link
Member

I just added a decodeEntities util to Gutenberg, and it was suggested it might be relevant here too.

Commit is at WordPress/gutenberg@f08c5f4 , if it's useful I'm happy to work on contributing it here.

@adamsilverstein
Copy link
Member Author

@notnownikki that does seem useful, not sure it belongs with sanitize? I had originally put these helpers in wp.utils, only later separating them out.

@ntwb
Copy link
Member

ntwb commented Jul 9, 2018

Issue moved to WordPress/gutenberg #7824 via ZenHub

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants