Skip to content

fix(Chip): render substring highlight as React nodes instead of raw HTML - #1448

Open
joydaven wants to merge 1 commit into
canonical:mainfrom
joydaven:fix/chip-unsafe-inner-html
Open

joydaven wants to merge 1 commit into
canonical:mainfrom
joydaven:fix/chip-unsafe-inner-html

Conversation

@joydaven

@joydaven joydaven commented Oct 17, 2026 •

Copy link
Copy Markdown

Done

  • Removed dangerouslySetInnerHTML from Chip and from the FilterPanelSection heading.
  • highlightSubString now returns React nodes with real <strong> elements for matches, so subString emphasis still works while values are rendered as text rather than parsed as HTML. An empty substring now reports match: false; every caller already guards against an empty search term.
  • Added tests for substring emphasis, quoted values, markup in values and headings rendering literally, and the utility's escaping. Added a Chip "Substring highlight" story.

Before / after


https://www.loom.com/share/7ed1536ead724322bed8de413f9a82b9

Before: When HTML is entered into the value input box, the output should render it as HTML instead of displaying it as plain text.

QA

Pinging @canonical/react-library-maintainers for a review.

QA steps

  • Run yarn docs, open Chip -> Default, set value to <b>bold</b> in Controls: it renders as plain text.
  • Open Chip → Substring highlight: the matched letters are bold.
  • In the SearchAndFilter story, type part of a section heading: the heading still emphasises it.
  • yarn test and yarn lint pass.

Percy steps

One new snapshot for the Chip "Substring highlight" story. No changes to existing stories expected.

Fixes

Fixes: #1091

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Unsanitized Inner HTML in Chip component

1 participant