ATLAS-5383: Atlas React UI: Upgrade sanitize-html dependency to version 2.17.6 - #732
Open
Brijesh619 wants to merge 3 commits into
Open
ATLAS-5383: Atlas React UI: Upgrade sanitize-html dependency to version 2.17.6#732Brijesh619 wants to merge 3 commits into
Brijesh619 wants to merge 3 commits into
Conversation
Contributor
Author
Contributor
Author
Contributor
Author
Contributor
Author
Contributor
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.







What changes were proposed in this pull request?
This PR resolves ATLAS-5383 by upgrading the
sanitize-htmldependency in the Atlas React UI (/dashboard) to version2.17.6.Upgrading this package introduces a known Jest environment error because its underlying transitive dependency (
htmlparser2) has switched to ESM syntax, which the default Jest test runner fails to parse natively at module load time. Additionally, the recent React Router v7 upgrade introduced globalTextEncoderrequirements that were failing in JSDOM.To safely perform this upgrade while strictly adhering to codebase standards (strict typing, correct indentation, and XSS testing) and keeping the test suite green, this PR includes the following changes:
sanitize-htmlto2.17.6inpackage.jsonandpackage-lock.json. Note that we intentionally did not enforce an"engines"requirement (e.g., forcing Node 22) inpackage.json. This keeps local development flexible and prevents unnecessary install/runtime warnings for developers currently on Node 20, while the Maven build continues to handle its own versioning viapom.xml.TextEncoderandTextDecoderpolyfills (via the native Nodeutilmodule) tosetupTests.simple.tsto resolve JSDOM crashes tied to the React Router v7 DOM upgrades. All polyfills are strictly typed (e.g., usingas unknown as typeof global.TextDecoderandObject.assign), fully avoiding unsafeanycasts.src/__mocks__/sanitize-html.ts) properly indented with 2 spaces to match the project style.SyntaxError: Cannot use import statement outside a modulecrash on module initialization, the mock evaluatesjest.requireActual('sanitize-html/index.js')lazily—bypassing the mock only when the function is actively called with configurationoptions._optionsparameter was renamed tooptionssince it is actively used, and all unsafeanycasts were replaced with a strictSanitizeFntype definition. For basic calls, the mock securely strips<script>tags via regex.Utils.test.ts. Because the mock dynamically yields to the real implementation, these tests successfully validate the upgraded package's AST parser against robust positive scenarios (the allowlist), negative scenarios (strippingiframe,img,onerror, andjavascript:protocols), and multiple edge cases (handlingnull,undefined, empty strings, andmailto:links).How was this patch tested?
Build & Type Tests:
npm installandnpm run buildto ensure the React UI compiles successfully without any build regressions.npm run typecheckandnpm run lintto verify strict TypeScript adherence with no unsafeanycasts.Unit & Integration Tests (Resolving crashes & testing XSS):
npm run test -- Utils.test.tsto verify the new integration tests successfully enforce the strictsanitize-htmloptions (rejecting malformed/XSS inputs while honoring the allowlist and correctly handling edge case inputs).npm run testglobally across the entire/dashboarddirectory. Verified that theTextEncoderpolyfills resolve all React Router test failures, the lazy-loaded mock efficiently intercepts renders without crashing on ESM imports, and the test suite correctly loads. All 189 test suites and 4,791 tests pass with a 100% success rate.Manual UI Verification:
sanitize-htmlAST parsing directly).