fix(render): escape speaker notes for JS and HTML-attribute contexts#3
Open
ntheanh201 wants to merge 1 commit into
Open
fix(render): escape speaker notes for JS and HTML-attribute contexts#3ntheanh201 wants to merge 1 commit into
ntheanh201 wants to merge 1 commit into
Conversation
ntheanh201
added a commit
to ntheanh201/talks
that referenced
this pull request
Jul 24, 2026
Add condensed teleprompter notes (time cue, key numbers, the land line, stage directions) as HTML comments on each Part 3 slide - shown in the presenter view, hidden from the audience. Bump slidr to the notes-escaping fix (slidr-cli/slidr#3) so multi-line notes render instead of blanking the deck. Signed-off-by: The Anh Nguyen <ntheanh201@gmail.com>
Slide notes are emitted into two contexts without correct escaping:
- slidr.js builds a JS string array with `{{ slide.notes|e }}`, which
HTML-escapes but does not JS-escape. A multi-line note then places a
raw newline inside a JS string literal - a syntax error that breaks
the whole script, so navigation dies and the deck renders blank.
- shell.html writes `data-notes="{{ slide.notes }}"` with no escaping,
so a double-quote in a note truncates the attribute.
Use `|tojson` for the JS array (a proper JSON string literal - newlines,
quotes and backslashes escaped, surrounding quotes included) and `|e`
for the HTML attribute. Add a test covering both contexts with a
multi-line, quote-containing note.
Signed-off-by: The Anh Nguyen <ntheanh201@gmail.com>
ntheanh201
force-pushed
the
fix/escape-slide-notes
branch
from
July 24, 2026 10:52
7f42054 to
e13e0e9
Compare
ntheanh201
added a commit
to ntheanh201/talks
that referenced
this pull request
Jul 24, 2026
slidr-cli master had advanced to the --dist flag while the notes-escape fix branched from an older commit. Rebased the fix onto current master so the submodule carries both, making the bump a clean forward move (slidr-cli/slidr#3). Signed-off-by: The Anh Nguyen <ntheanh201@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Slide notes (
<!-- ... -->comments) are emitted into two different contexts, each without the correct escaping:slidr.jsbuilds a JS string array with"{{ slide.notes|e }}". The|efilter HTML-escapes but does not JS-escape. A multi-line note therefore places a raw newline inside a JS string literal — a syntax error that breaks the entire script. Navigation stops working and the deck renders as a blank page.shell.htmlwritesdata-notes="{{ slide.notes }}"with no escaping at all, so a"inside a note truncates the attribute (the presenter view then shows a cut-off note).Single-line, quote-free notes happen to work, which is why this stays hidden until someone writes a richer note.
Fix
slidr.js"{{ slide.notes|e }}"{{ slide.notes|tojson }}shell.htmldata-notes="{{ slide.notes }}"data-notes="{{ slide.notes|e }}"Test
Adds
test_slide_notes_are_js_and_attribute_safe, which renders a slide with a multi-line, quote-containing note and asserts the JS array is JSON-encoded (newline escaped, no raw newline in the literal) and thedata-notesattribute escapes the quote. All 3 tests intest_html.pypass.Signed-off-by via DCO.