lizhimins commented on PR #5841:
URL: 
https://github.com/apache/rocketmq-dashboard/pull/5841#issuecomment-6120394502

   The escaping helper itself is fine, but the defect it guards against is not 
reachable with the catalog as it is defined. The summary table's six cells are 
`tool.Name`, `CLI.Resource`, `CLI.Verb`, `RiskLevel`, `Permission` and the 
joined `RequiredCapabilities` — none of them is free text: - `Description`, the 
only genuinely free-text field, is *not* in the table; it is emitted as a 
paragraph at `main.go:753`, where a newline is valid Markdown. - 
`requiredCapabilities` items are constrained by 
`server/src/main/resources/tool-catalog/rmq-tools.schema.json:87-93` to 
`^[A-Z][A-Z0-9_]*$`, so they can contain neither `|` nor a newline. - 
`riskLevel` is enum-validated at `main.go:627`. - Scanning all 14 catalog 
shards under `server/src/main/resources/tool-catalog/tools/`, the character `|` 
does not appear at all. The new test only reproduces the corruption by 
string-replacing `requiredCapabilities: []` with values the schema forbids. 
Closing as not reachable. If you want to harden this 
 area, the real gap is elsewhere and we would welcome a PR for it: the Go 
`validate()` in `rmqctl/internal/catalog/generate/main.go` does not enforce the 
`requiredCapabilities` pattern from `rmq-tools.schema.json` (it only 
enum-checks `riskLevel`), so the schema and the generator's own validator have 
diverged. Making the generator reject a non-conforming capability would remove 
the pipe/newline case by construction, which is strictly better than escaping 
it at render time. Note also that this PR conflicts with #5837 and #5843 (same 
two files, same append point in `main_test.go`); those two fix defects that are 
reachable today and will land first.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to