fix(gmail): add HTML draft creation guidance to generated skill#568
fix(gmail): add HTML draft creation guidance to generated skill#568kleinq wants to merge 1 commit intogoogleworkspace:mainfrom
Conversation
|
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request enhances the Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
The pull request introduces valuable guidance for creating HTML-formatted Gmail drafts, addressing the common issue of line wrapping in plain-text emails. The addition of a Python snippet to demonstrate the conversion process is very helpful. However, the Python snippet has a potential Cross-Site Scripting (XSS) vulnerability due to unsanitized user input being directly inserted into HTML. This should be addressed to prevent malicious content from being rendered.
| out.push_str("subject = \"Your Subject\"\n"); | ||
| out.push_str("body = \"\"\"Paragraph one line one.\\nStill paragraph one.\\n\\nParagraph two.\"\"\"\n\n"); | ||
| out.push_str("paragraphs = body.split('\\n\\n')\n"); | ||
| out.push_str("html_parts = ['<div>' + p.replace('\\n', '<br>').strip() + '</div>' for p in paragraphs]\n"); |
There was a problem hiding this comment.
The Python snippet constructs HTML by directly inserting the body content without proper HTML escaping. If the body variable contains malicious HTML or script tags (e.g., <script>alert('XSS')</script>), this could lead to a Cross-Site Scripting (XSS) vulnerability when the email is viewed by a recipient. It's crucial to HTML-escape any user-provided text that will be rendered as HTML to prevent such attacks.
To fix this, you should escape the p variable before concatenating it into the div tag. Python's html module (specifically html.escape) can be used for this purpose. Alternatively, if using a templating engine, it would handle escaping automatically.
For example, you could modify the line to include html.escape(p):
import html
# ... other code ...
html_parts = ['<div>' + html.escape(p.replace('\n', '<br>').strip()) + '</div>' for p in paragraphs]| out.push_str("html_parts = ['<div>' + p.replace('\\n', '<br>').strip() + '</div>' for p in paragraphs]\n"); | |
| html_parts = ['<div>' + html.escape(p.replace('\n', '<br>').strip()) + '</div>' for p in paragraphs] |
References
- Sanitize error strings printed to the terminal to prevent escape sequence injection.
| out.push_str("- Wrap in `<div dir=\"ltr\">...</div>`\n\n"); | ||
| out.push_str("```bash\n"); | ||
| out.push_str("python3 - <<'PYEOF'\n"); | ||
| out.push_str("import base64\n\n"); |
There was a problem hiding this comment.
To support the suggested fix for XSS in the html_parts generation, the html module needs to be imported. Please add import html at the beginning of the Python snippet.
| out.push_str("import base64\n\n"); | |
| import base64 | |
| import html |
|
FWIW, I've got adding draft support for the (Just waiting on another PR to land which touches at lot of the same code.) |
3 participants
Problem
When creating Gmail drafts via
gws gmail users drafts create, users naturallypass plain-text bodies in the raw RFC 2822 message. Plain-text emails are
line-wrapped by email clients (typically at 72–76 chars), breaking paragraph
flow and making the draft look unprofessional.
Fix
Add a
## Creating Draftssection to the generatedgws-gmailskill that:<div>/<br>conversion pattern(matching how Gmail's native compose formats messages)
RFC 2822 message with
Content-Type: text/htmlThis is a gmail-specific section (guarded by
alias == "gmail") so it onlyappears in the
gws-gmailskill, not in other service skills.Testing
Run
gws generate-skillsafter this change; the generatedskills/gws-gmail/SKILL.mdshould contain the new## Creating Draftssection before
## Discovering Commands.