sfirke opened a new issue, #43721:
URL: https://github.com/apache/superset/issues/43721
### Bug description
In a Handlebars chart, CSS entered in the **CSS Styles** box stops being
applied partway through and the remaining rules render as visible plain text in
the chart.
The cutoff is **positional, not content-dependent**: it always falls at the
**first blank line** in the CSS, no matter which rules are there. Reordering
rules doesn't help; the same rule works in one position and leaks in another.
`Handlebars.tsx` joins the template and the style block with a single
newline:
```ts
const templateSource = `${handlebarTemplateSource}\n${styleTemplateSource} `;
```
The result is rendered through `SafeMarkdown` (react-markdown → remark-parse
→ rehype-raw → rehype-sanitize).
When the template **starts with a block-level HTML tag** (`<table>`,
`<div>`, `<ul>`, …), that tag opens a [CommonMark HTML block type
6](https://spec.commonmark.org/0.31.2/#html-blocks), which ends at the first
blank line. Because there is no blank line before `<style>`, the `<style>` tag
is absorbed into that still-open block instead of starting its own **HTML block
type 1** (`<script>`/`<pre>`/`<style>`/`<textarea>`) — the one block type that
ignores blank lines and runs until a literal `</style>`.
So the first blank line inside the CSS terminates the HTML block, and every
rule after it is parsed as an ordinary Markdown paragraph and emitted as `<p>`
text.
This happens in **`remark-parse`**, before `rehype-raw` and
`rehype-sanitize` ever run. It is not a sanitization problem, and
`HTML_SANITIZATION_SCHEMA_EXTENSIONS` cannot fix it. Markdown parsing here is
spec-correct — the bug is the missing blank line in Superset's concatenation.
### Which inputs trigger it
This needs two ingredients, which is likely why it has gone unnoticed:
- The **Handlebars Template must begin with a block-level HTML tag.** If the
template begins with plain text or Markdown, `<style>` correctly interrupts the
paragraph and everything works. Toy templates tend to be fine; real ones that
open with `<table>` or `<div>` are not.
- The **CSS Styles box must contain a blank line.** Single-rule or
tightly-packed CSS works. Blank-line-separated rules — i.e. normal, readable
CSS — do not.
A line containing only spaces or a tab counts as blank and also triggers it.
An artifact of the two ingredients: it commonly looks like "exactly the
first two rule blocks work". The first survives inside the HTML block; the
second is then absorbed by parse5's RAWTEXT recovery inside `rehype-raw`. Both
the "2" and the fact that it is the *first* blank line, not the second, are
easy to mistake for a size limit. It is not size-related — CSS with 200+ rules
and no blank lines renders fine.
### How to reproduce
1. Create a Handlebars chart.
2. Handlebars Template:
```html
<table>
<tr><td>a</td></tr>
</table>
```
3. CSS Styles:
```css
td { color: red; }
th { color: blue; }
```
4. `td` is styled; `th { color: blue; }` renders as visible text.
Reproducible without a Superset instance, using the versions pinned in
`superset-ui-core/package.json` (`[email protected]`, `[email protected]`,
`[email protected]`, `[email protected]`, `[email protected]`) — the
mdast is already `[html, paragraph, paragraph, ...]` straight out of
`remark-parse`.
### Workaround
Add a **trailing blank line at the end of the Handlebars Template box**.
Combined with the `\n` Superset already adds, that produces the blank line the
parser needs, and the CSS can keep its normal formatting. (A trailing space
with no newline does not work.)
Alternatively, remove every blank line from the CSS.
### Related
Very likely the underlying cause of #30381, which is open and attributes the
same symptom to `HTML_SANITIZATION_SCHEMA_EXTENSIONS` not being read.
### Superset version
6.1.0 — also present on `master`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
