Rules: an opened entry shows its text's markdown literally (bold, ---) #1301

New issue

Closed

opened 2026-10-31 19:52:40 +00:00 by claude-bot · 1 comment

claude-bot commented

2026-10-31 19:52:40 +00:00

Collaborator

Found in the #1241 render check (31 Oct). It is already on main, from stage 1 (#1240).

An opened rules entry draws body_md as plain paragraphs, so pack text shows its markup:

**Serpentfolk Venom** (passive)
**Saving Throw** DC 22 Fortitude
--- rules between abilities

This shows on a creature's abilities under its stat block (Aapoph Granitescale in the PF2e starter pack), and in a campaign's Rules page and the library alike (EntryOpen in webapp/frontend/src/pages/wiki/rulesBrowse.jsx).

Fix:

Render body_md as markdown, with no raw HTML. react-markdown without rehype-raw, as HelpPage.jsx uses it. Check the bundle cost, since the Rules pages are lazy.
Or have the server send sanitised HTML (app/reference/sanitize.py, sanitize_markdown), if the search-hit card already does that. Look first at how components/rulePeek draws a rule.
Tests: bold, a horizontal rule, a list, and a <script> in the text drawn inert.

For 4.7.0, as a fix.

Found in the #1241 render check (31 Oct). It is already on main, from stage 1 (#1240). An opened rules entry draws `body_md` as plain paragraphs, so pack text shows its markup: - `**Serpentfolk Venom** (passive)` - `**Saving Throw** DC 22 Fortitude` - `---` rules between abilities This shows on a creature's abilities under its stat block (Aapoph Granitescale in the PF2e starter pack), and in a campaign's Rules page and the library alike (`EntryOpen` in `webapp/frontend/src/pages/wiki/rulesBrowse.jsx`). Fix: - Render `body_md` as markdown, with no raw HTML. react-markdown without rehype-raw, as `HelpPage.jsx` uses it. Check the bundle cost, since the Rules pages are lazy. - Or have the server send sanitised HTML (`app/reference/sanitize.py`, `sanitize_markdown`), if the search-hit card already does that. Look first at how `components/rulePeek` draws a rule. - Tests: bold, a horizontal rule, a list, and a `<script>` in the text drawn inert. For 4.7.0, as a fix.

claude-bot referenced this issue

2026-10-31 19:52:56 +00:00

feat(webapp): browse the rules, stage 2 — the rules library and Browse on a pack (#1241) #1300

rbrooks referenced this issue from a commit

2026-10-31 20:06:09 +00:00

fix(webapp): a rules entry's text is drawn from its markdown (#1301)

claude-bot commented

2026-10-31 20:06:14 +00:00

Author

Collaborator

Fixed in #1300, which touches the same code. Commit "a rules entry's text is drawn from its markdown".

RuleText draws an opened entry's text with react-markdown:

no raw HTML: a <script> shows as words and never runs;
no pictures: a picture shows as its alt text, so nothing is fetched from an address in a pack, as D297 does for wiki pages;
headings come down to bold lines under the page's own heading.

It's used by both the campaign Rules page and the library.

Checked on docker-test:

frontend lint: 0 errors;
4 new tests pass, and src/pages/wiki, src/pages/library and the pack page pass: 402 of 403. The one failure was Party.test.jsx timing out at a load average of 22; it passed when re-run alone (35/35, together with the new tests).

This closes when #1300 merges.

Fixed in #1300, which touches the same code. Commit "a rules entry's text is drawn from its markdown". `RuleText` draws an opened entry's text with react-markdown: - no raw HTML: a `<script>` shows as words and never runs; - no pictures: a picture shows as its alt text, so nothing is fetched from an address in a pack, as D297 does for wiki pages; - headings come down to bold lines under the page's own heading. It's used by both the campaign Rules page and the library. Checked on docker-test: - frontend lint: 0 errors; - 4 new tests pass, and `src/pages/wiki`, `src/pages/library` and the pack page pass: 402 of 403. The one failure was `Party.test.jsx` timing out at a load average of 22; it passed when re-run alone (35/35, together with the new tests). This closes when #1300 merges.

claude-bot closed this issue

2026-11-01 04:06:10 +00:00

claude-bot referenced this issue

2026-11-01 04:06:22 +00:00

Browse the rules, stage 2: a rules library per game system, outside any campaign #1241