Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[typescript] fix: escaped multiline comments; implementation option 1 #19528

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

joscha
Copy link
Contributor

@joscha joscha commented Sep 4, 2024

Currently, generated Typescript-code has escaped 's, etc. in the generated comment parts. This is due to the fact, that we currently use escapeText

everywhere, which has varying implementations for each target language. For Typescript it has:

// replace ' with \'
return super.escapeText(input).replace("\'", "\\\'");

which results in the aforementioned escaped sequence.

Example:
Screenshot 2024-09-04 at 2 20 58 PM
(origin here)

This pull request only escapes unsafe characters (currently multiline comments) for the descriptions of parameters, etc.

Note: The current implementation of escapeUnsafeCharacters does not guard for null, which is a possibility for any string passed. escapeText has the null guard. There are about a dozen @Overrides for escapeUnsafeCharacters, none of them guarding null (as it hasn't been used directly before, but only through escapeText, which has the guard). There were two options:

  1. Add null guards to all existing implementations
  2. Introduce a wrapper function like escapeText that guards for null and calls to escapeUnsafeCharacters

I chose 2) as it seemed more resilient, testable and also makes sure that other implementations out there and new ones in pull requests keep on working as expected. Let me know if you prefer 1) instead.

PR checklist

closes #19553, #19554

@joscha joscha changed the title [typescript] fix: Java-escaped multiline comments [typescript] fix: escaped multiline comments Sep 4, 2024
@@ -39,7 +39,7 @@ export class {{classname}}RequestFactory extends BaseAPIRequestFactory {
* {{&summary}}
{{/summary}}
{{#allParams}}
* @param {{paramName}} {{description}}
* @param {{paramName}} {{{description}}}
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I noticed here, that we HTML-escape the description. We don't anywhere else, so I fixed this on the way, but it is only tangentially related to the pull request. Please let me know if you'd like to revert this. There are currently no sample fixtures which are covering this codepath.

@@ -6,23 +6,23 @@ import { {{classname}} } from '{{filename}}{{importFileExtension}}';
{{/tsImports}}
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This file contains one half of the meaningful changes of this PR.

public void multilineCommentsAreEscaped() {
final DefaultCodegen codegen = new TypeScriptClientCodegen();
final String multilineComment = "/* This is a multiline comment */";
final String escapedComment = codegen.escapeUnsafeCharacters(multilineComment);
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

noticed escapeUnsafeCharacters was untested.

public void testEscapeUnsafeCharactersNullGuard() {
final DefaultCodegen codegen = new DefaultCodegen();

// allow null
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this asserts that the type guard exists in the newly introduced function.

@@ -1167,6 +1167,19 @@ public String escapeUnsafeCharacters(String input) {
return input;
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This file contains one half of the meaningful changes of this PR.

Copy link
Member

@macjohnny macjohnny left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks for your contribution!

@macjohnny macjohnny requested a review from wing328 September 4, 2024 15:16
@@ -100,6 +100,8 @@ public interface CodegenConfig {

String escapeUnsafeCharacters(String input);

String escapeUnsafeCharactersNullGuard(String input);
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I chose this name as that is what it currently does. Most implementations of escapeUnsafeCharacters are not actually about unsafe characters but about multiline comments, so we'd have the chance to name this escapeMultilineComment if we wanted, which would be more obvious, but has the caveat that the function it calls out to (escapeUnsafeCharacters) might not be aligned, so I left it with this slightly awkward suffix.

@@ -19,7 +19,8 @@ export class Capitalization {
'capitalSnake'?: string;
'sCAETHFlowPoints'?: string;
/**
* Name of the pet
* Name of the pet

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I didn't add trimming to the escapeUnsafeCharacters implementation. escapeText has it, hence why this now has an additional newline. Let me know if you prefer trimming leading and trailing whitespace for this and if yes, whether you prefer it for the Typescript generator in specific or generally for all implementations.

@wing328
Copy link
Member

wing328 commented Sep 9, 2024

Add null guards to all existing implementations

if it's not a lot of work, can you please file another PR to add null guards for the typescript generator(s)?

to me this approach seems more straightforward as I don't think we need 2 functions doing the same thing: one with null check and another one without null check.

@joscha
Copy link
Contributor Author

joscha commented Sep 9, 2024

Add null guards to all existing implementations

if it's not a lot of work, can you please file another PR to add null guards for the typescript generator(s)?

It's not too much. Do you want me to guard for null in any other generator as well, if need be, or wait until the issue occurs and we fix it then?

to me this approach seems more straightforward as I don't think we need 2 functions doing the same thing: one with null check and another one without null check.

Agree.

@joscha
Copy link
Contributor Author

joscha commented Sep 9, 2024

if it's not a lot of work, can you please file another PR to add null guards for the typescript generator(s)?

I opened three alternatives:

  1. [typescript] fix: escaped multiline comments; implementation option 1 #19528 (this PR), introduces a escapeUnsafeCharactersNullGuard
  2. [typescript] fix: escaped multiline comments; implementation option 2 #19553 moves the check into each individual generator
  3. [typescript] fix: escaped multiline comments; implementation option 3 #19554 pulls the null guard up into the parent codegen

Let me know what you think @wing328.

I think after seeing the three options side by side, my order of preference would be 3, 1, 2

@wing328
Copy link
Member

wing328 commented Sep 9, 2024

thanks for creating these PRs. i'll take a look later this week

@wing328
Copy link
Member

wing328 commented Sep 13, 2024

@joscha I might have missed it. Why not simply use {{{description}}} which is escaped to prevent code injection to address this particular problem?

@joscha
Copy link
Contributor Author

joscha commented Sep 13, 2024

@joscha I might have missed it. Why not simply use {{{description}}} which is escaped to prevent code injection to address this particular problem?

description has


applied, which is doing the ' to \' transformation.

@joscha joscha changed the title [typescript] fix: escaped multiline comments [typescript] fix: escaped multiline comments; implementation option 1 Sep 13, 2024
@wing328
Copy link
Member

wing328 commented Sep 13, 2024

applied, which is doing the ' to ' transformation.

If it doesn't replace ' with \', it will meet your requirement, right?

@joscha
Copy link
Contributor Author

joscha commented Sep 13, 2024

If it doesn't replace ' with \', it will meet your requirement, right?

yes, hence why in each of the fix PRs escapeUnsafeCharacters() is applied but not escapeText().

@joscha
Copy link
Contributor Author

joscha commented Sep 17, 2024

@wing328 @macjohnny any more thoughts on this? I think after seeing the three options side by side, my order of preference would be 3, 1, 2 (see #19528 (comment))

@macjohnny
Copy link
Member

@joscha I am fine with your suggestion. @wing328 can you approve?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants