Prevent html: escaping in broadcast later actions #362
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
broadcast_action_to accepts a content: argument to set the turbo-stream template content directly, bypassing any rendering. Other params, like partial: or locals: are delegated to render. Since the arguments are passed directly to render, you might expect you can also use html: as an argument here. However, there's a catch: when using a queue system to broadcast the action later, the html_safe flag of the html param might be lost in the serialization process. Specifically, the flag remains with queue backends that work in process (like `inline` or `async`) but it's lost in other that serialize the payload to JSON (like `resque` or `sidekiq`). The resulting effect is that the broadcast action works fine in development, but then fails when it's deployed to a production system. This problem seems to have tripped a few people: hotwired#284 Treating html: the same as content: solves the issue.
afcapel
commented
Jul 19, 2022
|
|
||
| assert_broadcast_on "stream", turbo_stream_action_tag("prepend", targets: ".message", template: "<span>test</span>") do | ||
| Turbo::StreamsChannel.broadcast_action_to "stream", action: "prepend", targets: ".message", html: "<span>test</span>" | ||
| end |
There was a problem hiding this comment.
This assertion fails without the change to broadcast_action_to.
afcapel
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
hotwire-rails documents using an
html:argument to broadcast HTML directly, bypassing the rendering mechanism.However, there's a catch: when using
html:with a broadcast later action and a queue system, thehtml_safeflag ofthe
htmlargument might be lost in the serialization process. Specifically, the flag remains with queue backends that work in-process (likeinlineorasync) but it's lost in others that serialize the payload to JSON (likeresqueor
sidekiq).Also,
renderescapes thehtml:param when it isn'thtml_safe.The resulting effect is that the broadcast action works fine in development, but then fails when it's deployed to a production system.
This problem seems to have tripped a few people already.
The solution is giving the
html:argument the same treatment as the existingcontent:param. This works because the we are bypassingrenderand hence there's no escaping.