feat: Reset the property to the default value on labels' Ctrl+click#36
Conversation
📝 WalkthroughWalkthroughInspector labels now support Ctrl/Cmd-click resets for eligible clip properties. Resets restore defaults, clear transition settings and matching keyframes, schedule saving, and re-render the inspector. README and CSS document and style the interaction. ChangesInspector property reset
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
Suggested reviewers: Sequence Diagram(s)sequenceDiagram
participant User
participant InspectorLabel
participant renderInspector
participant ClipProperties
participant SaveScheduler
User->>InspectorLabel: Ctrl/Cmd-click reset label
InspectorLabel->>renderInspector: Dispatch reset click
renderInspector->>ClipProperties: Restore defaults and clear matching state
renderInspector->>SaveScheduler: Schedule save
renderInspector->>InspectorLabel: Re-render inspector
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@app.js`:
- Line 2024: Update the textarea content interpolation in the row rendering to
HTML-escape p.text before it is passed to row and assigned through innerHTML,
ensuring characters such as <, >, &, and quotes cannot break out of the textarea
element while preserving the displayed text.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 692974a7-44a9-46b7-aa18-5f303c7c7b42
📒 Files selected for processing (3)
README.mdapp.jsstyle.css
| const known = [...SYSTEM_FONTS, ...runtime.customFonts, ...GOOGLE_FONTS, ...runtime.googleLoaded]; | ||
| html += `<div class="insp-section"><h3>Text</h3> | ||
| ${row("Content", `<textarea data-k="text">${p.text}</textarea>`)} | ||
| ${row("Content", `<textarea data-k="text">${p.text}</textarea>`, "", "text")} |
There was a problem hiding this comment.
🔒 Security & Privacy | 🔴 Critical | ⚡ Quick win
Escape the textarea content to prevent Cross-Site Scripting (XSS).
Directly interpolating p.text into the <textarea> allows a malicious payload (e.g., </textarea><script>alert(1)</script>) to break out of the tag and execute arbitrary JavaScript when the string is assigned to innerHTML below.
🐛 Proposed fix
- ${row("Content", `<textarea data-k="text">${p.text}</textarea>`, "", "text")}
+ ${row("Content", `<textarea data-k="text">${String(p.text).replace(/&/g, "&").replace(/</g, "<").replace(/>/g, ">")}</textarea>`, "", "text")}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| ${row("Content", `<textarea data-k="text">${p.text}</textarea>`, "", "text")} | |
| ${row("Content", `<textarea data-k="text">${String(p.text).replace(/&/g, "&").replace(/</g, "<").replace(/>/g, ">")}</textarea>`, "", "text")} |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@app.js` at line 2024, Update the textarea content interpolation in the row
rendering to HTML-escape p.text before it is passed to row and assigned through
innerHTML, ensuring characters such as <, >, &, and quotes cannot break out of
the textarea element while preserving the displayed text.
2 participants
What does this PR do?
Reset a property value on Ctrl+click in the inspector.
Type of change
How was it verified?
node --check server.js && node --check app.js && node --check mcp-server.jspassesCLAUDE.md/README.mdif the schema, props, or API changedChecklist
Summary by CodeRabbit
New Features
Documentation