Skip to content

ATLAS-5383: Atlas React UI: Upgrade sanitize-html dependency to version 2.17.6 - #732

Open
Brijesh619 wants to merge 3 commits into
apache:masterfrom
Brijesh619:ATLAS-5383
Open

ATLAS-5383: Atlas React UI: Upgrade sanitize-html dependency to version 2.17.6#732
Brijesh619 wants to merge 3 commits into
apache:masterfrom
Brijesh619:ATLAS-5383

Conversation

@Brijesh619

@Brijesh619 Brijesh619 commented Aug 19, 2026

Copy link
Copy Markdown
Contributor

What changes were proposed in this pull request?

This PR resolves ATLAS-5383 by upgrading the sanitize-html dependency in the Atlas React UI (/dashboard) to version 2.17.6.

Upgrading this package introduces a known Jest environment error because its underlying transitive dependency (htmlparser2) has switched to ESM syntax, which the default Jest test runner fails to parse natively at module load time. Additionally, the recent React Router v7 upgrade introduced global TextEncoder requirements that were failing in JSDOM.

To safely perform this upgrade while strictly adhering to codebase standards (strict typing, correct indentation, and XSS testing) and keeping the test suite green, this PR includes the following changes:

  1. Dependency Bumps & Version Flexibility: Bumped sanitize-html to 2.17.6 in package.json and package-lock.json. Note that we intentionally did not enforce an "engines" requirement (e.g., forcing Node 22) in package.json. This keeps local development flexible and prevents unnecessary install/runtime warnings for developers currently on Node 20, while the Maven build continues to handle its own versioning via pom.xml.
  2. Strictly Typed Jest Setup Polyfills: Added TextEncoder and TextDecoder polyfills (via the native Node util module) to setupTests.simple.ts to resolve JSDOM crashes tied to the React Router v7 DOM upgrades. All polyfills are strictly typed (e.g., using as unknown as typeof global.TextDecoder and Object.assign), fully avoiding unsafe any casts.
  3. Dynamic & Lazy-Loaded Jest Mock: Added a new mock (src/__mocks__/sanitize-html.ts) properly indented with 2 spaces to match the project style.
    • Fixes ESM Load Crashes: To avoid the SyntaxError: Cannot use import statement outside a module crash on module initialization, the mock evaluates jest.requireActual('sanitize-html/index.js') lazily—bypassing the mock only when the function is actively called with configuration options.
    • Strict Typing & Readability: The _options parameter was renamed to options since it is actively used, and all unsafe any casts were replaced with a strict SanitizeFn type definition. For basic calls, the mock securely strips <script> tags via regex.
  4. Comprehensive Integration Testing: Added dedicated integration test blocks inside Utils.test.ts. Because the mock dynamically yields to the real implementation, these tests successfully validate the upgraded package's AST parser against robust positive scenarios (the allowlist), negative scenarios (stripping iframe, img, onerror, and javascript: protocols), and multiple edge cases (handling null, undefined, empty strings, and mailto: links).

How was this patch tested?

Build & Type Tests:

  • Ran npm install and npm run build to ensure the React UI compiles successfully without any build regressions.
  • Ran npm run typecheck and npm run lint to verify strict TypeScript adherence with no unsafe any casts.

Unit & Integration Tests (Resolving crashes & testing XSS):

  • Ran npm run test -- Utils.test.ts to verify the new integration tests successfully enforce the strict sanitize-html options (rejecting malformed/XSS inputs while honoring the allowlist and correctly handling edge case inputs).
  • Ran npm run test globally across the entire /dashboard directory. Verified that the TextEncoder polyfills resolve all React Router test failures, the lazy-loaded mock efficiently intercepts renders without crashing on ESM imports, and the test suite correctly loads. All 189 test suites and 4,791 tests pass with a 100% success rate.

Manual UI Verification:

  • Started the local Vite dev server and verified that the UI loads and functions as expected in the browser (which ignores Jest mocks and utilizes the native sanitize-html AST parsing directly).

@Brijesh619

Copy link
Copy Markdown
Contributor Author
Screenshot from 2026-08-19 11-42-26 Screenshot from 2026-08-19 11-42-21

@Brijesh619

Copy link
Copy Markdown
Contributor Author
Screenshot from 2026-08-19 11-44-23

Comment thread dashboard/src/__mocks__/sanitize-html.ts Outdated
Comment thread dashboard/jest.config.js
Comment thread dashboard/jest.config.js
@Brijesh619

Copy link
Copy Markdown
Contributor Author
Screenshot from 2026-08-21 18-17-11

@Brijesh619

Copy link
Copy Markdown
Contributor Author
Screenshot from 2026-08-21 18-18-39

Comment thread dashboard/src/__mocks__/sanitize-html.ts Outdated
Comment thread dashboard/src/utils/__tests__/Utils.test.ts
Comment thread dashboard/package.json Outdated
Comment thread dashboard/src/__mocks__/sanitize-html.ts Outdated
Comment thread dashboard/src/__mocks__/sanitize-html.ts Outdated
Comment thread dashboard/src/utils/__tests__/Utils.test.ts
@Brijesh619

Copy link
Copy Markdown
Contributor Author
Screenshot from 2026-08-24 16-04-40 Screenshot from 2026-08-24 15-55-31

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants