render the generated reply as html instead of showing raw markdown - #446
Merged
Conversation
abhinavxd
marked this pull request as ready for review
July 30, 2026 11:23
Contributor
📝 WalkthroughWalkthroughAI-generated reply formatting is constrained by the copilot prompt, converted from Markdown to HTML by the backend, and preserved as HTML by the reply box for AI-generated replies. ChangesAI reply formatting
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@cmd/ai.go`:
- Line 298: Update the response handling around Markdown2HTML so SendEnvelope
never receives unescaped markdown as HTML when conversion fails. Propagate the
conversion error from Markdown2HTML, or escape its fallback before passing the
result to SendEnvelope while preserving the endpoint’s guaranteed-HTML contract.
- Line 298: Update the response handling around Markdown2HTML and SendEnvelope
so fallback AI output is sanitized before persistence or editor loading.
Sanitize raw HTML and reject dangerous URL schemes for both rendered Markdown
and error-fallback content, preserving the existing SendEnvelope flow while
ensuring no unsanitized model response reaches TextEditor.vue.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: fb313da2-c4d5-4b0d-83e9-a37fb12ee45e
📒 Files selected for processing (3)
cmd/ai.gofrontend/apps/main/src/features/conversation/ReplyBox.vueinternal/ai/copilot.go
| return sendErrorEnvelope(r, envelope.NewError(envelope.GeneralError, app.i18n.T("ai.emptyResponse"), nil)) | ||
| } | ||
| return r.SendEnvelope(resp) | ||
| return r.SendEnvelope(stringutil.Markdown2HTML(resp)) |
Contributor
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Preserve a guaranteed-HTML response contract.
Markdown2HTML returns the original markdown when conversion fails, but this endpoint now sends that fallback to the frontend as HTML. Return/propagate the conversion error or escape the fallback before sending it.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@cmd/ai.go` at line 298, Update the response handling around Markdown2HTML so
SendEnvelope never receives unescaped markdown as HTML when conversion fails.
Propagate the conversion error from Markdown2HTML, or escape its fallback before
passing the result to SendEnvelope while preserving the endpoint’s
guaranteed-HTML contract.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
rg -n -C3 'markdownRenderer|Markdown2HTML|goldmark|blackfriday|html/template' internal/stringutil/stringutil.go
rg -n -C3 'v-html|innerHTML|setContent|htmlContent' frontend/apps/main/src/features/conversationRepository: abhinavxd/libredesk
Length of output: 11078
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Go files mentioning Markdown2HTML:"
rg -n -C3 'Markdown2HTML' --glob '*.go' .
echo
echo "Relevant editor files:"
fd -i 'Editor' frontend/apps/main/src | sed -n '1,80p'
echo
echo "Search frontend for html/v-html/innerHTML assignments using model values or envelope data:"
rg -n -C3 'htmlContent|innerHTML|v-html|setContent|contenteditable|dangerouslySetInnerHTML|envelope|data\.data|Markdown|HTML' frontend/apps/main/src --glob '*.vue' --glob '*.ts' --glob '*.js' | sed -n '1,240p'Repository: abhinavxd/libredesk
Length of output: 22175
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Editor component files:"
fd -e vue . frontend/apps/main/src/components/editor | sort
echo
for f in frontend/apps/main/src/components/editor/*.vue; do
echo "===== $f ====="
wc -l "$f"
if [ "$f" = "frontend/apps/main/src/components/editor/TextEditor.vue" ] || [ "$f" = "frontend/apps/main/src/components/editor/CodeEditor.vue" ]; then
cat -n "$f"
fi
done
echo
echo "TextEditor references:"
rg -n -C4 'htmlContent|textContent|innerHTML|v-html|sanitize|DOMPurify|marked|showdown|highlight|prism|Quill|TipTap|TinyMCE|contenteditable' frontend/apps/main/src/components/editor frontend/apps/main/src/features/conversation frontend/apps/main/src --glob '*.vue' --glob '*.ts' --glob '*.js' | sed -n '1,260p'
echo
echo "Check local goldmark version/module references:"
grep -n 'github.com/yuin/goldmark' go.mod go.sum -A2 -B2 || trueRepository: abhinavxd/libredesk
Length of output: 49352
Sanitize AI HTML before loading it into the editor.
Markdown2HTML escapes raw HTML for normal Markdown output, but any error fallback returns the model response as plain HTML. TextEditor.vue then assigns htmlContent.value through editor.commands.setContent(...), so fallback HTML can bypass the Markdown renderer’s protections. Ensure the fallback also sanitizes raw HTML and dangerous URL schemes before it is persisted or loaded into the editor.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@cmd/ai.go` at line 298, Update the response handling around Markdown2HTML and
SendEnvelope so fallback AI output is sanitized before persistence or editor
loading. Sanitize raw HTML and reject dangerous URL schemes for both rendered
Markdown and error-fallback content, preserving the existing SendEnvelope flow
while ensuring no unsanitized model response reaches TextEditor.vue.
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit