h2oai / h2oai/wave

ui.table with markdown doesn't render text html.escape()

Open
#2,392 1 comment 0 reactions 0 assignees View on GitHub
bug ui
Dominant language
Python
Stars
4.3k
Forks
371
Avg merge
26d 1h
Merged PRs (30d)
1

Description

#### Wave SDK Version, OS

Wave 1.5.1

#### Actual behavior

Given I have some html text that I want to display in ui.table, together with other markdown text in the the same column. I want to prevent code injection attacks, so I am using html.escape() on all text first.

When rendering in Wave, some escaped html characters are not visualized correctly:

escaped csv
```
Name: Content, dtype: object
0 <ul>\r
1 <ul>\r
2 <li><label for="usermail&quo...
3 <li><label for="usermail&quo...
Name: Content, dtype: object
```

so, somehow `

    ` gets visualized correctly while `
  • Email` is rendered with escaped strings `<`.

    ![image](https://github.com/user-attachments/assets/a47c3ef6-f0e2-453d-a54b-48a3ea732376)

    #### Expected behavior

    Render escaped markdown in ui.table()

    #### Potential improvement

    Add a flag to force safe rendering in ui.table() to reduce the risk of code injection.

Contributor guide

Open the contributing guide

Research direction

Reproduce the ui.table() case with html.escape() on mixed HTML and markdown, comparing the

    and
  • / examples. Trace the table's markdown rendering path; done means escaped content displays correctly without executing HTML, with regression coverage for the reported input.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
frontend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.