Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (4)
WalkthroughAdds two Markdown postprocessing steps (separate adjacent callouts; convert HTML Changes
Sequence Diagram(s)sequenceDiagram
participant Generator as Page Generator
participant PostProc as Post-processors
participant Renderer as Site Renderer
rect rgba(100, 150, 200, 0.5)
Note over Generator,Renderer: Generation → Postprocess → Render pipeline
end
Generator->>Generator: generate & validate pages (slug→content)
Generator->>PostProc: pass pages dict
PostProc->>PostProc: for each page: separate_adjacent_callouts(content)
PostProc->>PostProc: then convert_details_to_headings(content)
PostProc->>Renderer: return transformed pages dict
Renderer->>Renderer: sanitize URLs via _is_safe_url() and render HTML
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related issues
Suggested labels
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Collaborator
|
Report bugs in Issues Welcome! 🎉This pull request will be automatically processed with the following features: 🔄 Automatic Actions
📋 Available CommandsPR Status Management
Review & Approval
Testing & Validation
Container Operations
Cherry-pick Operations
Label Management
✅ Merge RequirementsThis PR will be automatically approved when the following conditions are met:
📊 Review ProcessApprovers and ReviewersApprovers:
Reviewers:
Available Labels
AI Features
💡 Tips
For more information, please refer to the project documentation or contact the maintainers. |
myakove
force-pushed
the
fix/issue-55-generation-pipeline-bugs
branch
from
fa47cde to
5810d3d
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@src/docsfy/renderer.py`:
- Around line 63-86: Normalize and validate the URL by decoding HTML entities
first, then stripping whitespace, and run all checks against this normalized
value in _is_safe_url; specifically call _html_mod.unescape on the raw url, then
.strip() the result, then (1) reject protocol-relative URLs by checking
normalized.startswith("//"), (2) allow absolute paths with
normalized.startswith("/") but not "//", (3) check allowed schemes using
case-insensitive comparison (lowercase the prefix or parsed.scheme) for
("http://","https://","mailto:","#"), and (4) use urllib.parse.urlsplit on the
normalized value to determine if a scheme exists and treat no-scheme (relative)
as safe; ensure all earlier startswith checks use the normalized string so
whitespace/entity-encoded bypasses are prevented.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: f89eef42-1d1d-4318-be1f-e70d557292e4
📒 Files selected for processing (4)
src/docsfy/api/projects.pysrc/docsfy/postprocess.pysrc/docsfy/prompts.pysrc/docsfy/renderer.py
myakove
force-pushed
the
fix/issue-55-generation-pipeline-bugs
branch
from
5810d3d to
dce6a4e
Compare
myakove
commented
Apr 17, 2026
Contributor
Author
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@src/docsfy/postprocess.py`:
- Around line 56-91: The adjacent-callout logic incorrectly treats any prior '>'
line as the start of a callout, causing inserts between a multi-line callout
body and its continuation; update the block in the loop that currently checks
lines[prev_idx].strip().startswith(">") so it only treats the previous non-empty
blockquote as an adjacent callout if that prior line actually matches
_CALLOUT_RE (i.e., use _CALLOUT_RE.match on the trimmed previous line instead of
a plain startswith(">")); keep the existing behaviour of removing blank lines
via result.pop() and appending separators when a true callout adjacency is
detected, and also replace the two startswith checks for backticks/ tildes with
a single startswith(("```","~~~")) call.
- Around line 28-38: The current regexes are too strict: change _DETAILS_OPEN_RE
to allow any content (including HTML) inside <summary> by matching non-greedily
up to the literal </summary> (e.g. use a pattern like
r"<details[^>]*>\s*<summary\b[^>]*?>([\s\S]*?)</summary>" with re.IGNORECASE) so
summaries containing tags like <strong> match, and relax _DETAILS_CLOSE_RE to
match a closing </details> anywhere (e.g. r"</details>" with re.IGNORECASE)
instead of requiring it on its own line; keep the existing substitution order
(run the open-summary replacement first and then the close replacement, as the
current .sub("\n", ...) call site expects) so you don’t accidentally consume
unrelated whitespace.
In `@src/docsfy/renderer.py`:
- Around line 63-81: The _is_safe_url function is already handling HTML-decoding
before stripping and performing a case-insensitive scheme check so no functional
change is required; leave _is_safe_url as implemented (including the checks for
"http://", "https://", "#", "mailto:", leading "/" vs "//", and the final
urllib.parse.urlsplit-based scheme detection). If you prefer a tiny style tweak
(optional), you can collapse the last conditional by returning not parsed.scheme
instead of the explicit if/return, but this is purely stylistic and not
required.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 10ffc358-d0a3-4952-96bb-7ccce1dfa217
📒 Files selected for processing (4)
src/docsfy/api/projects.pysrc/docsfy/postprocess.pysrc/docsfy/prompts.pysrc/docsfy/renderer.py
myakove
force-pushed
the
fix/issue-55-generation-pipeline-bugs
branch
from
dce6a4e to
c7ef2ae
Compare
Contributor
Author
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@src/docsfy/postprocess.py`:
- Around line 32-35: _REGEX _DETAILS_CLOSE_RE currently consumes surrounding
whitespace around the closing </details> tag and replacement code replaces the
whole match with a newline, collapsing blank lines; change the regex to only
match the tag (e.g. re.compile(r"</details>", re.IGNORECASE)) so surrounding
newlines/spaces are preserved, and ensure the code that removes the tag (the
re.sub call that currently uses _DETAILS_CLOSE_RE) replaces the match with an
empty string (not a newline); apply the same change to the other similar
match/replacement pair referenced in the comment.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 3fba3344-0347-4387-b06c-886d7691a32a
📒 Files selected for processing (4)
src/docsfy/api/projects.pysrc/docsfy/postprocess.pysrc/docsfy/prompts.pysrc/docsfy/renderer.py
… callouts, unrendered markdown in HTML blocks Fixes #55 - Allow relative URLs in HTML sanitizer while blocking dangerous schemes (javascript:, data:, protocol-relative //evil.com, entity-encoded colons) - Add separate_adjacent_callouts() to split merged Note/Warning/Tip callouts - Add convert_details_to_headings() to convert <details> blocks to ## headings - Update AI prompts to forbid <details>/<summary> tags in all page types - Apply post-processing before render_site in generation pipeline
myakove
force-pushed
the
fix/issue-55-generation-pipeline-bugs
branch
from
c7ef2ae to
4d1c643
Compare
Contributor
Author
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
Collaborator
|
New container for ghcr.io/myk-org/docsfy:latest published |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #55
Changes
Bug 1: Related Pages links all
href="#"(High)The HTML sanitizer in
renderer.pyblocked relative URLs likepage-slug.htmlbecause they didn't match allowed schemes (http://,https://,#,/,mailto:).Fix: Added
_is_safe_url()helper that allows scheme-less relative URLs while blocking dangerous schemes (javascript:,data:, protocol-relative//evil.com, HTML entity-encoded colons likejavascript:alert(1)).Bug 2: Adjacent blockquote callouts collapse (Medium)
Consecutive
>callouts (Note/Warning/Tip) merged into a single blockquote, losing severity styling.Fix: Added
separate_adjacent_callouts()inpostprocess.pythat detects adjacent callouts with different prefixes and inserts blank line separators. Handles both backtick and tilde code fences.Bug 3: Markdown inside
<details>not rendered (Medium)The Python
markdownlibrary can't parse Markdown inside raw HTML blocks, so**bold**appeared literally.Fix:
<details>/<summary>tags (shared_NO_HTML_DETAILSconstant)convert_details_to_headings()post-processor to convert any remaining<details>blocks to##headings_CODE_BLOCK_RE.split()Wiring
Both post-processors applied in
api/projects.pybeforerender_site().Files Changed
src/docsfy/renderer.py— URL sanitizer fixsrc/docsfy/postprocess.py— Two new post-processing functionssrc/docsfy/prompts.py— Updated AI writing rulessrc/docsfy/api/projects.py— Pipeline wiringTesting
Summary by CodeRabbit
Bug Fixes
New Features
Documentation