LearnNewsExamplesServices
Frontmatter
id8450
titleAdd validation to Markdown component to reject HTML 404 responses
stateClosed
labels
enhancementai
assigneestobiu
createdAtJan 9, 2026, 9:37 AM
updatedAtJan 9, 2026, 9:39 AM
githubUrlhttps://github.com/neomjs/neo/issues/8450
authortobiu
commentsCount1
parentIssuenull
subIssues[]
subIssuesCompleted0
subIssuesTotal0
blockedBy[]
blocking[]
closedAtJan 9, 2026, 9:39 AM

Add validation to Markdown component to reject HTML 404 responses

Closed v11.19.1 enhancementai
tobiu
tobiu commented on Jan 9, 2026, 9:37 AM

When fetching markdown files via AJAX, a 404 error often returns a full HTML page. This causes the Markdown component to render a full DOM tree inside itself, triggering CSP warnings like: "The Content Security Policy ... was delivered via a element outside the document's "

Changes:

  • Implement beforeSetValue in Neo.component.Markdown.
  • Check if the input value looks like a full HTML document (e.g. starts with <!DOCTYPE html> or <html).
  • If detected, log a console error and prevent the update by returning oldValue.
tobiu added the enhancement label on Jan 9, 2026, 9:37 AM
tobiu added the ai label on Jan 9, 2026, 9:37 AM
tobiu referenced in commit 6bfadbf - "feat: Add validation to Markdown component to reject HTML 404 responses (#8450)" on Jan 9, 2026, 9:38 AM
tobiu assigned to @tobiu on Jan 9, 2026, 9:39 AM
tobiu
tobiu Jan 9, 2026, 9:39 AM

Input from Gemini 3 Pro:

✦ Implemented beforeSetValue in Neo.component.Markdown to intercept values starting with <!DOCTYPE html> or <html. This prevents the component from rendering 404 error pages as content, which previously caused CSP warnings and rendering artifacts.

tobiu closed this issue on Jan 9, 2026, 9:39 AM