Conversation
…e UI escapeJsAttr() lives inside the one giant template literal that getVariablesEditorHtml() returns as the page's inline <script>. Its backslash-escaping regexes were written for a standalone file, but the outer template literal consumes one level of backslash-escaping when the .ts source is parsed — so the browser received a syntactically broken script (Invalid regular expression: /\/g, '\').replace(/: Unmatched ')'). The resulting SyntaxError aborted the entire inline script, so neither the Schema nor the Values tab ever rendered, regardless of whether the schema had any tags. Doubles the escaping to compensate for the extra template-literal layer, verified against the exact embedded-string pipeline. Adds a regression test that extracts every <script> block from the rendered page and parses it with `new Function()`, which fails on the old code and passes on the fix.
fix: Variables Editor client script fails to parse, blanking the whole UI
# [1.2.0-beta.3](v1.2.0-beta.2...v1.2.0-beta.3) (2026-08-07) ### Bug Fixes * Variables Editor client script fails to parse, blanking the whole UI ([2e48b2e](2e48b2e))
📝 WalkthroughWalkthroughThe Variables Editor now preserves JavaScript string escaping for schema-derived HTML attributes. A regression test checks embedded script parsing. The package version and changelog now identify release ChangesVariables Editor script escaping
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@CHANGELOG.md`:
- Line 4: Change the “Bug Fixes” heading from H3 to H2 so it follows the H1
release heading without skipping a level and satisfies markdownlint MD001.
In `@src/lib/variables-editor.ts`:
- Line 529: Update escapeJsAttr() to escape carriage return, newline, U+2028,
and U+2029 in addition to backslashes and single quotes, applying these
JavaScript escapes before escapeHtml() so generated single-quoted inline
handlers remain valid.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 1627dcc8-20db-4ff4-b887-fffc5d0373aa
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (4)
CHANGELOG.mdpackage.jsonsrc/lib/variables-editor.tstests/unit/lib/variables-editor.spec.ts
| # [1.2.0-beta.3](https://github.com/mi-examples/pp-dev/compare/v1.2.0-beta.2...v1.2.0-beta.3) (2026-08-07) | ||
|
|
||
|
|
||
| ### Bug Fixes |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Fix the heading-level jump.
Line 1 uses an H1 release heading. Line 4 uses an H3 heading. This skips H2 and triggers markdownlint MD001. Change ### Bug Fixes to ## Bug Fixes.
Suggested fix
-### Bug Fixes
+## Bug Fixes📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| ### Bug Fixes | |
| ## Bug Fixes |
🧰 Tools
🪛 markdownlint-cli2 (0.23.2)
[warning] 4-4: Heading levels should only increment by one level at a time
Expected: h2; Actual: h3
(MD001, heading-increment)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@CHANGELOG.md` at line 4, Change the “Bug Fixes” heading from H3 to H2 so it
follows the H1 release heading without skipping a level and satisfies
markdownlint MD001.
Source: Linters/SAST tools
| // context first, then HTML-escape the result so it can't break out of the attribute either. | ||
| function escapeJsAttr(s) { | ||
| return escapeHtml(String(s).replace(/\\/g, '\\\\').replace(/'/g, "\\'")); | ||
| return escapeHtml(String(s).replace(/\\\\/g, '\\\\\\\\').replace(/'/g, "\\\\'")); |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Escape JavaScript line terminators as well.
Although the backslash fix resolves the reported issue, escapeJsAttr() still leaves \r, \n, U+2028, and U+2029 unchanged. A schema-derived list-column name containing one of these characters can make the generated single-quoted inline handler invalid. Add JavaScript escapes for these characters before calling escapeHtml().
Suggested source-level fix
- return escapeHtml(String(s).replace(/\\\\/g, '\\\\\\\\').replace(/'/g, "\\\\'"));
+ return escapeHtml(
+ String(s)
+ .replace(/\\\\/g, '\\\\\\\\')
+ .replace(/'/g, "\\\\'")
+ .replace(/\\r/g, '\\\\r')
+ .replace(/\\n/g, '\\\\n')
+ .replace(/\\u2028/g, '\\\\u2028')
+ .replace(/\\u2029/g, '\\\\u2029'),
+ );🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/lib/variables-editor.ts` at line 529, Update escapeJsAttr() to escape
carriage return, newline, U+2028, and U+2029 in addition to backslashes and
single quotes, applying these JavaScript escapes before escapeHtml() so
generated single-quoted inline handlers remain valid.
3 participants
Summary
Patch for a bug in the just-released v1.2.0:
escapeJsAttr()(added in #227's XSS fix) lives inside the single giant template literal thatgetVariablesEditorHtml()returns as the page's inline<script>. Its backslash-escaping regexes were correct for a standalone file, but the outer template literal consumes one level of backslash-escaping when the.tssource itself is parsed — so the browser received a syntactically broken script:That
SyntaxErroraborted the entire inline script, so neither the Schema nor the Values tab ever rendered — reproduced live against a consumer project running@metricinsights/pp-dev@1.2.0.Key changes
escapeJsAttr()to compensate for the extra template-literal unescape pass.tests/unit/lib/variables-editor.spec.ts) that extracts every<script>block from the rendered page and parses it withnew Function()— fails on the pre-fix code, passes on the fix.Included commits
Testing
npx tsc --noEmit— cleannpm run lint— cleannpm run test:unit— 275/275 passingMerge Request:
origin/develop→origin/mainSummary by CodeRabbit
Bug Fixes
Tests
Chores