Repository navigation
Conversation
…s as text The item search result list and grid, and the journal, journal volume, project and org unit result templates, bound the submitter-entered dc.description with [innerHTML]. Angular's sanitizer drops scripts but keeps <a href> and <img src>, so a description could inject links and external images into result listings on the repository origin. dc.description is not a Solr hit-highlight field, so the value never carries <em> markup and HTML rendering is not needed. Use text interpolation instead, as ds-clarin-item-box-view already does.
jr-rk
marked this pull request as ready for review
October 27, 2026 13:18
There was a problem hiding this comment.
🟡 Changes recommended
Add HTML-markup regression coverage for the project, journal, journal-volume, and org-unit result components.
5 open issues
What changed in this PR
This pull request prevents stored dc.description content from being interpreted as HTML in item and entity search results.
Changes:
- Replaces
[innerHTML]with text interpolation across item, project, journal, journal-volume, and org-unit result templates. - Adds regression tests for HTML-containing item descriptions in list and grid results.
- Preserves language attributes and existing truncation behavior.
| File | Summary |
|---|---|
src/app/shared/object-list/search-result-list-element/item-search-result/item-types/item/item-search-result-list-element.component.spec.ts |
Tests that item description markup renders as text in list results. |
src/app/shared/object-list/search-result-list-element/item-search-result/item-types/item/item-search-result-list-element.component.html |
Renders item descriptions as text in list results. |
src/app/shared/object-grid/search-result-grid-element/item-search-result/item/item-search-result-grid-element.component.spec.ts |
Tests that item description markup renders as text in grid results. |
src/app/shared/object-grid/search-result-grid-element/item-search-result/item/item-search-result-grid-element.component.html |
Renders item descriptions as text in grid results. |
src/app/entity-groups/research-entities/item-list-elements/search-result-list-elements/org-unit/org-unit-search-result-list-element.component.html |
Renders org-unit descriptions as text. |
src/app/entity-groups/research-entities/item-grid-elements/search-result-grid-elements/project/project-search-result-grid-element.component.html |
Renders project descriptions as text. |
src/app/entity-groups/journal-entities/item-grid-elements/search-result-grid-elements/journal/journal-search-result-grid-element.component.html |
Renders journal descriptions as text. |
src/app/entity-groups/journal-entities/item-grid-elements/search-result-grid-elements/journal-volume/journal-volume-search-result-grid-element.component.html |
Renders journal-volume descriptions as text. |
Review effort: Lite
Wire the HTML-in-dc.description fixture into the journal, journal volume and project grid specs through getEntityGridElementTestComponent, and add the same check to the org unit list spec, so that reverting any of those templates to [innerHTML] fails a test.
Port of upstream DSpace/dspace-angular PR 4881 (the 7.x backport of 4737). The list, grid and detail result components, the name service and the metadata representations escape metadata values by default. The result list and grid keep showing dc.description, now escaped. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Solr returns hit highlights with the stored value unescaped, so they are
escaped too and only the <em> tags are kept. makeLinks (item page
description, full item page), the facet suggestions, the autocomplete
suggestions and the request-copy item name escape the value as well.
Values shown with {{ }} or kept as name variants opt out, so they are not
escaped twice.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
milanmajchrak
changed the title
The name comes from virtual metadata of the related entity. It has no hit highlights, so it does not need HTML. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
References
dspace-customers issue 1083, finding R65. Ports upstream DSpace/dspace-angular PR 4881 (the 7.x backport of 4737).
Description
Many components render submitter metadata with
[innerHTML], and Angular's sanitizer keeps<a href>and<img src>. So a title, author or description could put links and external images into search results and onto the item page. The metadata is now escaped before it reaches[innerHTML].Instructions for Reviewers
List of changes in this PR:
ea656192b5is the upstream port.Metadata,DSpaceObject.firstMetadataValue,DSONameService.getNameandgetHitHighlightstake anescapeHTMLflag. The result list, grid and detail components escape by default.dc.descriptionin the result list and grid stays[innerHTML], now escaped.Metadata.escapeHighlight: Solr returns hit highlights with the stored value unescaped, so highlights are escaped too and only the<em>tags are kept. Upstream does not escape highlights.makeLinksescapes the text and adds only its own<a>tags. It rendersdc.descriptionon the item page and the values on the full item page.dsEmphasize(facet filter suggestions), the autocomplete and sponsor suggestions, and the item name on the request-copy page escape the value.{{ }}.{{ }}passfalse, so they are not escaped twice: journal editor and publisher, org unit address, item grid date. Person and org unit name variants stay unescaped, and their input suggestions use{{ }}.<a>and<img>renders as text in the item and entity results) still apply.A value that really contains HTML, for example
<i>in a title, is now shown as text. Upstream behaves the same.How to test:
Result: all specs pass. With the old highlight,
makeLinks,dsEmphasizeand autocomplete code, the 8 new specs fail.Manual: set an item's
dc.titletoTest <img src="https://example.org/x.png">and itsdc.descriptionto<a href="https://example.org">link</a> see https://example.org. Search forTestand open the item. The tags show as text, the search highlight still shows, and the plain URL in the description is still a link.Not changed, because the HTML there is meant to be HTML or is covered elsewhere:
AI Disclosure (REQUIRED)
Were AI tools used in the creation of this PR?
Claude Code ported the upstream change, wrote the CLARIN fixes and the tests. The new specs fail without the escaping and pass with it. Lint passes locally.
Checklist
mainbranch of code (unless it is a backport or is fixing an issue specific to an older branch).yarn lintyarn check-circ-deps)package.json), I've made sure their licenses align with the DSpace BSD License based on the Licensing of Contributions documentation.🤖 Generated with Claude Code