ui.table with markdown doesn't render text html.escape()
- Dominant language
- Python
- Stars
- 4.3k
- Forks
- 371
- Avg merge
- 26d 1h
- Merged PRs (30d)
- 1
Description
#### Wave SDK Version, OS
Wave 1.5.1
#### Actual behavior
Given I have some html text that I want to display in ui.table, together with other markdown text in the the same column. I want to prevent code injection attacks, so I am using html.escape() on all text first.
When rendering in Wave, some escaped html characters are not visualized correctly:
escaped csv
```
Name: Content, dtype: object
0 <ul>\r
1 <ul>\r
2 <li><label for="usermail&quo...
3 <li><label for="usermail&quo...
Name: Content, dtype: object
```
so, somehow `
- ` gets visualized correctly while `
- Email` is rendered with escaped strings `<`.

#### Expected behavior
Render escaped markdown in ui.table()
#### Potential improvement
Add a flag to force safe rendering in ui.table() to reduce the risk of code injection.
Contributor guide
Research direction
Reproduce the ui.table() case with html.escape() on mixed HTML and markdown, comparing the
- and
- / examples. Trace the table's markdown rendering path; done means escaped content displays correctly without executing HTML, with regression coverage for the reported input.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- frontend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100