Conversation
Adds a Redirect Pages section to the Templates docs showing how to use the object array template type to generate meta-refresh HTML pages for URL migrations. Includes an XSS-safe escapeXml helper, a note on SEO implications of meta-refresh, and an example of generating a Netlify _redirects file instead. Closes #237
Coverage Report for CI Build 24619424796Coverage remained the same at 91.469%Details
Uncovered ChangesNo uncovered changes found. Coverage RegressionsNo coverage regressions found. Coverage Stats
💛 - Coveralls |
There was a problem hiding this comment.
Pull request overview
Adds documentation for an idiomatic DomStack pattern to generate redirect artifacts via templates, aimed at helping users migrate URLs without built-in redirect support.
Changes:
- Adds a “Redirect Pages” documentation section with an object-array template example that generates meta-refresh HTML redirect pages.
- Adds a second example showing how to generate a Netlify/Cloudflare Pages
_redirectsfile via a template. - Includes an inline escaping helper and brief SEO guidance.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| The `outputName` field controls the output path. Using `${from}/index.html` creates a directory-style URL at the old path. The `escapeXml` helper prevents XSS if any redirect target contains special characters. | ||
|
|
There was a problem hiding this comment.
The docs claim escapeXml "prevents XSS" in redirect targets, but HTML-escaping alone doesn’t prevent dangerous URL schemes (eg javascript:) from being used in href / meta-refresh destinations. Consider narrowing the claim (prevents HTML injection) and/or recommending validating/sanitizing to to allow only relative URLs or http(s) destinations.
There was a problem hiding this comment.
Narrowed the claim -- the text now says escapeXml "prevents HTML injection" rather than "prevents XSS", since HTML-escaping doesn't stop javascript: URLs (which is already called out separately).
Move the Redirect Pages section from under TypeScript Support to its correct location at the end of the Templates section. Fix the prose to accurately describe escapeXml scope (HTML injection only, not javascript: scheme), warn about leading / in from values resolving outside the build dir, and use correct template type terminology (single-object template type). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
Addressed all four review comments:
|
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds a "Redirect Pages" section to the Templates documentation showing how to generate meta-refresh HTML redirect pages for URL migrations using the object array template type.
The example covers:
index.htmlper redirect entry with a correct meta-refresh and canonical linkescapeXmlhelper to prevent XSS in redirect targets_redirectsfile insteadDomStack has no built-in redirect mechanism, so this documents the idiomatic template-based approach that any migrating site would otherwise need to discover independently.
Closes #237