Skip to content

Unescaped HTML rendered in /crate page #2725

Closed
@gbj

Description

@gbj

I have a crate that does HTML rendering, and therefore uses HTML tags within backticks at several points in its crate-level doc comments.

i.e., it opens

//! # Leptos Meta
//!
//! Leptos Meta allows you to modify content in a document’s `<head>` from within components
//! using the [`Leptos`](https://github.com/leptos-rs/leptos) web framework.

This is correctly rendered as Markdown with the HTML in backticks escaped at docs.rs/leptos_meta

<p>Leptos Meta allows you to modify content in a document’s <code>&lt;head&gt;</code> from within components
using the <a href="https://github.com/leptos-rs/leptos"><code>Leptos</code></a> web framework.</p>

But it is injected directly into the page as plain text, not rendered to Markdown and therefore containing unescaped HTML at docs.rs/crate/leptos_meta:

<div class="pure-u-1 pure-u-sm-17-24 pure-u-md-19-24 package-details" id="main">
   # Leptos Meta
    
  Leptos Meta allows you to modify content in a document’s `<head>` from within components
   using the [`Leptos`](https://github.com/leptos-rs/leptos) web framework.

This causes rendering issues, as can be seen by navigating to the two pages.

Because the Content-Security Policy would prevent any <script> tag from executing, I don't think there's any security issue here, just the rendering one.

It's also possible I'm doing something wrong and this is documented somewhere, in which case a pointer to those docs would be helpful so I can fix it.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions