Repository navigation
Show a session's reason as text - #108
Conversation
A session's reason and a sensitive access's justification are text a console user typed. Rinku links their URLs but passes everything else through as markup, so render them escaped first: Rinku still links the URLs, and anything else shows as the characters typed. Tests cover both, with a URL carrying a query string, and pin that executed code shows as text too.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
There was a problem hiding this comment.
🟢 Approved
No active review issues are reported for the changes that render user-entered reasons and justifications as text while preserving clickable URLs.
No open issues 🎉
What changed in this PR
This PR renders user-entered session reasons and sensitive-access justifications as text rather than HTML, while preserving clickable URLs in the audit interface.
Changes:
- Adds
text_with_linksto escape text before linking URLs. - Uses the helper in the session header and executed-code card.
- Adds integration coverage for literal markup, linked URLs, and escaped executed code.
[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or rungh pr ready --undo.
Click "Ready for review" or rungh pr readyto reengage.
| File | Description |
|---|---|
test/integration/session_text_test.rb |
Tests text rendering, URL preservation, and escaped executed code. |
app/views/audits1984/sessions/_header.html.erb |
Renders session reasons through the new helper. |
app/views/audits1984/sessions/_executed_code.html.erb |
Renders sensitive-access justifications through the new helper. |
app/helpers/audits1984/application_helper.rb |
Adds shared escaping and URL-linking behavior. |
Review effort: Balanced
|
@codex review |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Review threads: none. Copilot approved 527c3fe. |
|
You have reached your Codex usage limits. You can see your limits in the Codex usage dashboard. |
basecamp/audits1984#108: the session header and the sensitive access card render the reason and justification escaped, with URLs still linked.
A session's reason and a sensitive access's justification are text that a console user typed. The session header and the executed-code card passed them to
Rinku.auto_linkand thenhtml_safe. Rinku links URLs but passes everything else through as markup, so a reason containing<b>rendered bold.This adds
text_with_links, which escapes the text and then links it. Both views use it. URLs are still linked: one with a query string keeps its&in thehref, and anything else shows as the characters typed.Every other place audits1984 shows session data already escapes it. That covers the username in the header, the breadcrumb and the session list; the reason in the session list (
<%= %>); executed code, which goes through Rouge's HTML formatter; and the JSON views, which go through Jbuilder.test/integration/session_text_test.rbrenders a session whose reason, justification and command contain markup and URLs. For the reason and the justification, it checks that no element is created, that the text shows as typed, and that the URL is linked. Without the view change, both of those tests fail. It also pins that executed code shows as text. Full suite: 62 runs, 0 failures.