fix: escape Rich markup in catalog list output - #3738
Merged
mnriem merged 1 commit intoJul 27, 2026
Conversation
The `catalog list` subcommands for workflows, workflow steps, presets, and integrations printed user-editable catalog fields (name/url/ description from the `*-catalogs.yml` files) through `console.print` with Rich markup enabled. Any bracketed content such as a description `Does [stuff] nicely` was parsed as a style tag and silently swallowed, and a malformed tag could raise while rendering. Route each untrusted field through the module's already-imported `escape` helper, matching the pattern already used by `extension catalog list`. Adds regression tests for all four commands that inject bracketed name/url/description and assert the brackets survive verbatim in the output. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Escapes user-controlled catalog metadata before Rich rendering, preserving bracketed content across catalog-list commands.
Changes:
- Escapes catalog names, URLs, and descriptions in four CLI commands.
- Adds regression coverage for each affected command.
Show a summary per file
| File | Description |
|---|---|
src/specify_cli/workflows/_commands.py |
Escapes workflow and step catalog fields. |
src/specify_cli/presets/_commands.py |
Escapes preset catalog fields. |
src/specify_cli/integrations/_query_commands.py |
Escapes integration catalog fields. |
tests/test_workflows.py |
Tests workflow and step output. |
tests/test_presets.py |
Tests preset output. |
tests/integrations/test_integration_catalog.py |
Tests integration output. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 6/6 changed files
- Comments generated: 0
- Review effort level: Medium
mnriem
approved these changes
Jul 27, 2026
mnriem
approved these changes
Jul 27, 2026
Collaborator
|
Thank you! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The
catalog listsubcommands print user-editable catalog fields (name,url,descriptionfrom the*-catalogs.ymlconfig files) throughconsole.print, which has Rich markup enabled. Any bracketed content is parsed as a style tag and silently swallowed — e.g. a catalog descriptionDoes [stuff] nicelyrenders asDoes nicely— and a malformed tag can raise while rendering.This affects four commands whose sibling
extension catalog listalready escapes these fields:specify workflow catalog list(workflows/_commands.py)specify workflow step catalog list(workflows/_commands.py)specify preset catalog list(presets/_commands.py)specify integration catalog list(integrations/_query_commands.py)Fix
Route each untrusted field through the module's already-imported
escapehelper (from rich.markup import escape), matching the reference pattern inextension catalog list. No new imports.Tests
Adds a regression test per command that injects bracketed
name/url/descriptionand asserts the brackets survive verbatim in the output. Confirmed each test fails without the corresponding source fix (test-the-test via stash).The 20 unrelated
test_workflows.pysymlink-guard failures in my local run are pre-existing Windows-without-elevation failures, not touched by this change.🤖 Generated with Claude Code