ADFA-2611: Fix tooltip HTML tags rendering as literal text#893
Conversation
Remove Html.escapeHtml() from tooltip summary and detail content so HTML formatting tags (e.g., <b> for bold) render properly in the WebView instead of displaying as literal text.
📝 Walkthrough
WalkthroughSimplified tooltip HTML generation by removing HTML escaping for summary content and refactoring detail handling to use Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Actionable comments posted: 0
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
idetooltips/src/main/java/com/itsaky/androidide/idetooltips/ToolTipManager.kt (1)
280-297: Potential XSS risk with unescaped database content rendered in JavaScript-enabled WebView.Removing
Html.escapeHtml()allows HTML formatting to render, but also opens a potential XSS vector since:
- JavaScript is enabled on the WebView (line 321)
- The debug database can be loaded from external storage (
/Download/documentation.db), which is user-accessibleIf a malicious database contains
<script>tags or event handlers (e.g.,<img onerror="...">), they would execute in the WebView context.Consider one of these mitigations:
- Sanitize HTML to allow only safe formatting tags (
<b>,<i>,<br>, etc.) while stripping scripts and event handlers- Disable JavaScript on the WebView if not strictly required for tooltip rendering
- Only allow unescaped HTML from the bundled production database, not the debug database
Android WebView HTML sanitization libraries for safe HTML rendering
🧹 Nitpick comments (1)
idetooltips/src/main/java/com/itsaky/androidide/idetooltips/ToolTipManager.kt (1)
321-323: Consider disabling JavaScript if not required for tooltip display.With HTML escaping removed, keeping JavaScript enabled increases the attack surface. If the tooltips only need to render basic HTML formatting (
<b>,<br>, etc.), JavaScript can be disabled:♻️ Suggested change
- webView.settings.javaScriptEnabled = true + webView.settings.javaScriptEnabled = false
Remove Html.escapeHtml() from tooltip summary and detail content so HTML formatting tags (e.g., <b> for bold) render properly in the WebView instead of displaying as literal text.
Remove Html.escapeHtml() from tooltip summary and detail content
so HTML formatting tags (e.g., for bold) render properly in
the WebView instead of displaying as literal text.