Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Slightly broken Markdown formatting when used with --desc #314

Closed
woodruffw opened this issue Jun 30, 2022 · 2 comments · Fixed by #323
Closed

Slightly broken Markdown formatting when used with --desc #314

woodruffw opened this issue Jun 30, 2022 · 2 comments · Fixed by #323
Assignees
Labels
bug Something isn't working component:output-formats Supported output formats

Comments

@woodruffw
Copy link
Member

This is a relatively minor bug: the combination of --desc and --format=markdown might result in a broken Markdown table, since --desc can include multiple lines of embedded Markdown from the vulnerability service.

For example, from the self-test on our GitHub Action: https://github.com/trailofbits/gh-action-pip-audit/actions/runs/2592038764

Screen Shot 2022-06-30 at 2 52 43 PM


I see two possible solutions (but there are probably others!):

  • Forbid the combination of --desc and --format=markdown
    • Pros: Arguably the most correct, since --desc is explicitly allowed to contain Markdown per the OSV spec on vulnerability descriptions
    • Cons: Makes the Markdown format a little less useful.
  • "Collapse" the Markdown into a single line
    • Pros: Preserves descriptions in the Markdown table, which aren't multiple lines 99% of the time.
    • Cons: Will slightly mis-render any Markdown descriptions that contain multiple lines, if those multiple lines are semantically important (e.g. headings)

I'm slightly leaning towards the second.

@woodruffw
Copy link
Member Author

This will be partially alleviated (but not fixed) by pypi/warehouse#11734, since we'll be able to use the summary instead of the full description, when present.

@woodruffw woodruffw added upstream Items that require upstream work or coordination and removed upstream Items that require upstream work or coordination labels Jul 13, 2022
@woodruffw
Copy link
Member Author

No longer blocked upstream; I can make the needed changes here today.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working component:output-formats Supported output formats
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant