• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

knowledgepixels / nanodash / 23688905990

28 Mar 2026 04:02PM UTC coverage: 16.298% (+0.02%) from 16.274%
23688905990

push

github

tkuhn
feat: support <pre> in HTML sanitization and improve _multi_val handling

- Add <pre> to allowed HTML sanitizer elements and looksLikeHtml pattern
- Unify _multi_val to always split on newlines, checking each part
  individually for IRI vs literal (replaces looksLikeSpaceSeparatedIris)
- Add HTML sanitization support in QueryResultList _multi_val path
- Remove top/bottom margins on <pre> elements

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

756 of 5699 branches covered (13.27%)

Branch coverage included in aggregate %.

1902 of 10610 relevant lines covered (17.93%)

2.46 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

0.0
src/main/java/com/knowledgepixels/nanodash/component/QueryResultTable.java
1
package com.knowledgepixels.nanodash.component;
2

3
import com.knowledgepixels.nanodash.*;
4
import com.knowledgepixels.nanodash.domain.MaintainedResource;
5
import com.knowledgepixels.nanodash.page.NanodashPage;
6
import com.knowledgepixels.nanodash.page.PublishPage;
7
import com.knowledgepixels.nanodash.repository.MaintainedResourceRepository;
8
import com.knowledgepixels.nanodash.template.Template;
9
import org.apache.wicket.Component;
10
import org.apache.wicket.ajax.AjaxRequestTarget;
11
import org.apache.wicket.ajax.form.AjaxFormComponentUpdatingBehavior;
12
import org.apache.wicket.behavior.AttributeAppender;
13
import org.apache.wicket.extensions.ajax.markup.html.repeater.data.table.AjaxNavigationToolbar;
14
import org.apache.wicket.extensions.markup.html.repeater.data.grid.ICellPopulator;
15
import org.apache.wicket.extensions.markup.html.repeater.data.table.*;
16
import org.apache.wicket.markup.html.basic.Label;
17
import org.apache.wicket.markup.html.form.TextField;
18
import org.apache.wicket.markup.html.link.AbstractLink;
19
import org.apache.wicket.markup.html.link.BookmarkablePageLink;
20
import org.apache.wicket.markup.repeater.Item;
21
import org.apache.wicket.model.IModel;
22
import org.apache.wicket.model.Model;
23
import org.apache.wicket.request.mapper.parameter.PageParameters;
24
import org.eclipse.rdf4j.model.IRI;
25
import org.nanopub.extra.services.ApiResponse;
26
import org.nanopub.extra.services.ApiResponseEntry;
27
import org.nanopub.extra.services.QueryRef;
28
import org.slf4j.Logger;
29
import org.slf4j.LoggerFactory;
30

31
import java.util.ArrayList;
32
import java.util.List;
33

34
/**
35
 * Component for displaying query results in a table format.
36
 */
37
public class QueryResultTable extends QueryResult {
38

39
    private static final Logger logger = LoggerFactory.getLogger(QueryResultTable.class);
×
40

41
    private Model<String> errorMessages = Model.of("");
×
42
    private DataTable<ApiResponseEntry, String> table;
43
    private Label errorLabel;
44
    private FilteredQueryResultDataProvider filteredDataProvider;
45
    private Model<String> filterModel = Model.of("");
×
46

47
    QueryResultTable(String id, QueryRef queryRef, ApiResponse response, ViewDisplay viewDisplay, boolean plain) {
48
        super(id, queryRef, response, viewDisplay);
×
49

50
        if (plain) {
×
51
            add(new Label("label").setVisible(false));
×
52
            add(new Label("np").setVisible(false));
×
53
            showViewDisplayMenu = false;
×
54
        } else {
55
            String label = grlcQuery.getLabel();
×
56
            if (viewDisplay.getTitle() != null) {
×
57
                label = viewDisplay.getTitle();
×
58
            }
59
            add(new Label("label", label));
×
60
        }
61

62
        errorLabel = new Label("error-messages", errorMessages);
×
63
        errorLabel.setVisible(false);
×
64
        add(errorLabel);
×
65

66
        TextField<String> filterField = new TextField<>("filter", filterModel);
×
67
        filterField.setOutputMarkupId(true);
×
68
        filterField.add(new AjaxFormComponentUpdatingBehavior("change") {
×
69
            @Override
70
            protected void onUpdate(AjaxRequestTarget target) {
71
                if (filteredDataProvider != null && table != null) {
×
72
                    filteredDataProvider.setFilterText(filterModel.getObject());
×
73
                    target.add(table);
×
74
                }
75
            }
×
76
        });
77
        add(filterField);
×
78

79
        populateComponent();
×
80
    }
×
81

82
    private void addErrorMessage(String errorMessage) {
83
        String s = errorMessages.getObject();
×
84
        if (s.isEmpty()) {
×
85
            s = "Error: " + errorMessage;
×
86
        } else {
87
            s += ", " + errorMessage;
×
88
        }
89
        errorMessages.setObject(s);
×
90
        errorLabel.setVisible(true);
×
91
        if (table != null) table.setVisible(false);
×
92
    }
×
93

94
    @Override
95
    protected void populateComponent() {
96
        List<IColumn<ApiResponseEntry, String>> columns = new ArrayList<>();
×
97
        QueryResultDataProvider dataProvider;
98
        try {
99
            for (String h : response.getHeader()) {
×
100
                if (h.endsWith("_label") || h.endsWith("_label_multi")) {
×
101
                    continue;
×
102
                }
103
                String displayLabel = h;
×
104
                if (displayLabel.endsWith("_multi_iri")) {
×
105
                    displayLabel = displayLabel.substring(0, displayLabel.length() - "_multi_iri".length());
×
106
                } else if (displayLabel.endsWith("_multi_val")) {
×
107
                    displayLabel = displayLabel.substring(0, displayLabel.length() - "_multi_val".length());
×
108
                } else if (displayLabel.endsWith("_multi")) {
×
109
                    displayLabel = displayLabel.substring(0, displayLabel.length() - "_multi".length());
×
110
                }
111
                columns.add(new Column(displayLabel.replaceAll("_", " "), h));
×
112
            }
113
            if (viewDisplay.getView() != null && !viewDisplay.getView().getViewEntryActionList().isEmpty()) {
×
114
                columns.add(new Column("", Column.ACTIONS));
×
115
            }
116
            dataProvider = new QueryResultDataProvider(response.getData());
×
117
            filteredDataProvider = new FilteredQueryResultDataProvider(dataProvider, response);
×
118
            table = new DataTable<>("table", columns, filteredDataProvider, viewDisplay.getPageSize() < 1 ? Integer.MAX_VALUE : viewDisplay.getPageSize());
×
119
            table.setOutputMarkupId(true);
×
120
            table.addBottomToolbar(new AjaxNavigationToolbar(table));
×
121
            table.addBottomToolbar(new NoRecordsToolbar(table));
×
122
            table.addTopToolbar(new HeadersToolbar<String>(table, dataProvider));
×
123
            add(table);
×
124
        } catch (Exception ex) {
×
125
            logger.error("Error creating table for query {}", grlcQuery.getQueryId(), ex);
×
126
            add(new Label("table", "").setVisible(false));
×
127
            addErrorMessage(ex.getMessage());
×
128
        }
×
129
    }
×
130

131
    private class Column extends AbstractColumn<ApiResponseEntry, String> {
132

133
        private String key;
134
        public static final String ACTIONS = "*actions*";
135

136
        public Column(String title, String key) {
×
137
            super(new Model<String>(title), key);
×
138
            this.key = key;
×
139
        }
×
140

141
        @Override
142
        public void populateItem(Item<ICellPopulator<ApiResponseEntry>> cellItem, String componentId, IModel<ApiResponseEntry> rowModel) {
143
            try {
144
                View view = viewDisplay.getView();
×
145
                if (key.equals(ACTIONS) && view != null) {
×
146
                    List<AbstractLink> links = new ArrayList<>();
×
147
                    for (IRI actionIri : view.getViewEntryActionList()) {
×
148
                        // TODO Copied code and adjusted from QueryResultTableBuilder:
149
                        Template t = view.getTemplateForAction(actionIri);
×
150
                        if (t == null) continue;
×
151
                        String targetField = view.getTemplateTargetFieldForAction(actionIri);
×
152
                        if (targetField == null) targetField = "resource";
×
153
                        String label = view.getLabelForAction(actionIri);
×
154
                        if (label == null) label = "action...";
×
155
                        if (!label.endsWith("...")) label += "...";
×
156
                        PageParameters params = new PageParameters().set("template", t.getId())
×
157
                                .set("param_" + targetField, contextId)
×
158
                                .set("context", contextId)
×
159
                                .set("template-version", "latest");
×
160
                        if (partId != null && contextId != null && !partId.equals(contextId)) {
×
161
                            params.set("part", partId);
×
162
                        }
163
                        String partField = view.getTemplatePartFieldForAction(actionIri);
×
164
                        if (partField != null) {
×
165
                            // TODO Find a better way to pass the MaintainedResource object to this method:
166
                            MaintainedResource r = MaintainedResourceRepository.get().findById(contextId);
×
167
                            if (r != null && r.getNamespace() != null) {
×
168
                                params.set("param_" + partField, r.getNamespace() + "<SET-SUFFIX>");
×
169
                            }
170
                        }
171
                        String queryMapping = view.getTemplateQueryMapping(actionIri);
×
172
                        if (queryMapping != null && queryMapping.contains(":")) {
×
173
                            // This part is different from the code in QueryResultTableBuilder:
174
                            String queryParam = queryMapping.split(":")[0];
×
175
                            String templateParam = queryMapping.split(":")[1];
×
176
                            params.set("param_" + templateParam, rowModel.getObject().get(queryParam));
×
177
                        }
178
                        params.set("refresh-upon-publish", queryRef.getAsUrlString());
×
179
                        AbstractLink button = new BookmarkablePageLink<NanodashPage>("button", PublishPage.class, params);
×
180
                        button.setBody(Model.of(label));
×
181
                        links.add(button);
×
182
                    }
×
183
                    cellItem.add(new ButtonList(componentId, resourceWithProfile, links, null, null));
×
184
                } else {
×
185
                    String value = rowModel.getObject().get(key);
×
186
                    if (key.endsWith("_multi_iri")) {
×
187
                        String[] uris = value.split(" ");
×
188
                        String labelKey = key.substring(0, key.length() - "_multi_iri".length()) + "_label_multi";
×
189
                        String labelValue = rowModel.getObject().get(labelKey);
×
190
                        String[] labels = labelValue != null ? labelValue.split("\n", -1) : null;
×
191
                        List<Component> links = new ArrayList<>();
×
192
                        for (int i = 0; i < uris.length; i++) {
×
193
                            String label = (labels != null && i < labels.length) ? Utils.unescapeMultiValue(labels[i]) : null;
×
194
                            links.add(new NanodashLink("component", uris[i], null, null, label, contextId));
×
195
                        }
196
                        cellItem.add(new ComponentSequence(componentId, ", ", links));
×
197
                    } else if (key.endsWith("_multi_val")) {
×
198
                        String labelKey = key.substring(0, key.length() - "_multi_val".length()) + "_label_multi";
×
199
                        String labelValue = rowModel.getObject().get(labelKey);
×
200
                        String[] parts = value.split("\n", -1);
×
201
                        String[] labels = labelValue != null ? labelValue.split("\n", -1) : null;
×
202
                        List<Component> components = new ArrayList<>();
×
203
                        for (int i = 0; i < parts.length; i++) {
×
204
                            String part = parts[i];
×
205
                            String label = (labels != null && i < labels.length) ? Utils.unescapeMultiValue(labels[i]) : null;
×
206
                            if (part.matches("https?://.+")) {
×
207
                                components.add(new NanodashLink("component", part, null, null, label, contextId));
×
208
                            } else {
209
                                String display = label != null ? label : Utils.unescapeMultiValue(part);
×
210
                                if (Utils.looksLikeHtml(display)) {
×
211
                                    components.add(new Label("component", Utils.sanitizeHtml(display))
×
212
                                            .setEscapeModelStrings(false)
×
213
                                            .add(new AttributeAppender("class", "cell-data-html")));
×
214
                                } else {
215
                                    components.add(new Label("component", display));
×
216
                                }
217
                            }
218
                        }
219
                        cellItem.add(new ComponentSequence(componentId, ", ", components));
×
220
                    } else if (key.endsWith("_multi")) {
×
221
                        String[] parts = value.split("\n", -1);
×
222
                        String labelKey = key.substring(0, key.length() - "_multi".length()) + "_label_multi";
×
223
                        String labelValue = rowModel.getObject().get(labelKey);
×
224
                        String[] labels = labelValue != null ? labelValue.split("\n", -1) : null;
×
225
                        List<Component> components = new ArrayList<>();
×
226
                        for (int i = 0; i < parts.length; i++) {
×
227
                            String display;
228
                            if (labels != null && i < labels.length) {
×
229
                                display = Utils.unescapeMultiValue(labels[i]);
×
230
                            } else {
231
                                display = Utils.unescapeMultiValue(parts[i]);
×
232
                            }
233
                            if (Utils.looksLikeHtml(display)) {
×
234
                                components.add(new Label("component", Utils.sanitizeHtml(display))
×
235
                                        .setEscapeModelStrings(false)
×
236
                                        .add(new AttributeAppender("class", "cell-data-html")));
×
237
                            } else {
238
                                components.add(new Label("component", display));
×
239
                            }
240
                        }
241
                        cellItem.add(new ComponentSequence(componentId, ", ", components));
×
242
                    } else if (value.matches("https?://.+")) {
×
243
                        String label = rowModel.getObject().get(key + "_label");
×
244
                        cellItem.add(new NanodashLink(componentId, value, null, null, label, contextId));
×
245
                    } else {
×
246
                        if (key.startsWith("pubkey")) {
×
247
                            cellItem.add(new Label(componentId, value).add(new AttributeAppender("style", "overflow-wrap: anywhere;")));
×
248
                        } else {
249
                            Label cellLabel;
250
                            if (Utils.looksLikeHtml(value)) {
×
251
                                cellLabel = (Label) new Label(componentId, Utils.sanitizeHtml(value))
×
252
                                        .setEscapeModelStrings(false)
×
253
                                        .add(new AttributeAppender("class", "cell-data-html"));
×
254
                            } else {
255
                                cellLabel = new Label(componentId, value);
×
256
                            }
257
                            cellItem.add(cellLabel);
×
258
                        }
259
                    }
260
                }
261
            } catch (Exception ex) {
×
262
                logger.error("Failed to populate table column: ", ex);
×
263
                cellItem.add(new Label(componentId).setVisible(false));
×
264
                addErrorMessage(ex.getMessage());
×
265
            }
×
266
        }
×
267

268
    }
269

270
//    private class ApiResponseComparator implements Comparator<ApiResponseEntry>, Serializable {
271
//
272
//        private SortParam<String> sortParam;
273
//
274
//        public ApiResponseComparator(SortParam<String> sortParam) {
275
//            this.sortParam = sortParam;
276
//        }
277
//
278
//        @Override
279
//        public int compare(ApiResponseEntry o1, ApiResponseEntry o2) {
280
//            String p = sortParam.getProperty();
281
//            int result;
282
//            if (o1.get(p) == null && o2.get(p) == null) {
283
//                result = 0;
284
//            } else if (o1.get(p) == null) {
285
//                result = 1;
286
//            } else if (o2.get(p) == null) {
287
//                result = -1;
288
//            } else {
289
//                result = o1.get(p).compareTo(o2.get(p));
290
//            }
291
//            if (!sortParam.isAscending()) result = -result;
292
//            return result;
293
//        }
294
//
295
//    }
296

297
}
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2026 Coveralls, Inc