Skip to content

Conversation

@serikjensen
Copy link
Member

This PR has some fixes for duplicate entries in the autogenerated component adapter props inventory.

This also adds pre-commit functionality for when *Types.ts files are edited within the UI directory and ensures the autogenerated prop documentation executes so we can better keep that in sync.

Proof of functionality

Making a change to a *Types.ts file within the UI directory

  • Runs the generate adapter docs script
  • Formats the output for the component inventory markdown file
  • Adds the component inventory to the current commit

https://drive.google.com/file/d/116k1wtRn8hcBxUMZ0M1U76-qi3zpZcOi/view?usp=drive_link

Making a change to a non types file

Observe that the adapter generate command does not run

Screen.Recording.2025-10-29.at.2.47.03.PM.mov

@@ -3,6 +3,8 @@
- [AlertProps](#alertprops)
- [BadgeProps](#badgeprops)
- [BaseListProps](#baselistprops)
- [BreadcrumbsProps](#breadcrumbsprops)
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note that this file is autogenerated, the differences come from formatting updates where we ensure this file is formatted consistently for the updates

@dryrunsecurity
Copy link

dryrunsecurity bot commented Oct 29, 2025

DryRun Security

This pull request introduces a documentation generation issue: JSDoc descriptions are inserted into a Markdown table without escaping, allowing special characters (e.g., |, *, #) in comments to break table layout or inject unintended formatting in component-inventory.md. Although not flagged as blocking, this can corrupt generated docs and should be fixed by properly escaping or sanitizing Markdown output.

Markdown Injection in Generated Documentation (Description Field) in build/generateAdapterPropDocs.ts
Vulnerability Markdown Injection in Generated Documentation (Description Field)
Description The getDescription function extracts JSDoc comments, but the output is inserted directly into a Markdown table cell in component-inventory.md without proper Markdown escaping. This allows special Markdown characters (e.g., ``, *, `#`) within JSDoc comments to break the table layout or inject unintended formatting into the generated documentation. Although the 'threat actor' is a developer with commit access, this leads to unintentional documentation corruption and broken Markdown.

jsDocs
.map(doc => doc.getComment() || '')
.join(' ')
.replace(/[\n\r]+/g, ' ')
.replace(/\s+/g, ' ')
.trim() || '-'
)
}


All finding details can be found in the DryRun Security Dashboard.

@serikjensen serikjensen requested a review from dmortal October 29, 2025 20:54
Copy link
Contributor

@jeffredodd jeffredodd left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@serikjensen serikjensen enabled auto-merge (squash) October 30, 2025 15:01
@serikjensen serikjensen merged commit 06c6a5e into main Oct 30, 2025
9 checks passed
@serikjensen serikjensen deleted the feat/GWS-5802 branch October 30, 2025 15:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants