Skills grid: fix Install/Source click (JSON-in-attribute broke on esc) - #134
Merged
Conversation
Clicking Install or Source threw "Uncaught SyntaxError ... JSON at position 1":
the skill entry was stashed as JSON.stringify() in a data-entry attribute via
esc(), but the shared esc() (text→innerHTML) does NOT escape double quotes, so
the JSON's quotes closed the attribute early and getAttribute returned "{".
Carry the entry as individual data-* attrs (source/sourceLabel/name/repo/ref/
path/url) read back into an object — no JSON in markup. Added a local attr()
that adds the missing quote-escape, so any field is attribute-safe.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Symptom
Clicking Install or Source in the skills grid threw:
Uncaught SyntaxError: Expected property name or '}' in JSON at position 1(atJSON.parse).Cause
The skill entry was stashed as
JSON.stringify({...})inside adata-entry="..."attribute, escaped with the sharedtigerDataTable.esc. Butesc()serializes via text→innerHTML, which escapes&<>but not". The JSON's double quotes closed the attribute early, sogetAttribute('data-entry')returned just{→JSON.parsefailed.Fix
Carry the entry as individual
data-*attributes (source,sourceLabel,name,repo,ref,path,url) and read them back into an object — no JSON in markup, noJSON.parse. Added a localattr()=esc()+"→"so any field is genuinely attribute-safe (the general quote-escape gapesc()has).View-only; deployed to tiger-dev. Install / Source (browse + installed) and the modal-install all work.
🤖 Generated with Claude Code