Package page shows truncated HTML in the description

[hamedniroomand]

Describe the bug

On https://npmx.dev/package/vue-tsc the description shows leftover HTML: <img src="https://img.s

npm cuts description at 255 characters. vue-tsc puts badge HTML in that field, so the cut lands in the middle of an <img> tag. We strip complete tags, but not a tag with no closing >.

Additional context

No response

Logs

[gameroman]

Should it maybe show this as a description in this case?

A command-line type checking tool for Vue, based on a `tsc` wrapper, enabling the TypeScript compiler to understand `.vue` files.

So instead of just stripping HMTL tags, it would skip them instead

[hamedniroomand]

@gameroman

I think that sentence isn’t the package description, it’s from the README (the first paragraph after the badges), which we already show further down the page. Putting it in the description slot as well would duplicate it.

vue-tsc doesn’t actually set a description in package.json. The registry seems to fill that field from the start of the README (the badge HTML) and then truncates it at 255 characters, which is why we get leftover markup. So this looks more like a content/metadata issue than a missing description we can recover.

I’m also not sure we’d have a reliable way to decide which part of a README should stand in as the description. Showing “No description provided” after stripping the leftover HTML feels more honest to me than duplicating README text with a heuristic. What do you think?

[gameroman]

I think that sentence isn’t the package description, it’s from the README (the first paragraph after the badges) which we already show further down the page.

Yes, that package doesn't have description at all

Putting it in the description slot as well would duplicate it.

Yes, that's we already do. We should discuss if we want to show a description on the package page if there is no description in package.json

I think it was originally done to show some description on non-package pages, for example search or user page

I’m also not sure we’d have a reliable way to decide which part of a README should stand in as the description.

What do you think?

Probably go from top to bottom, skipping title and img/non-text html tags

[hamedniroomand]

That makes sense @gameroman
I’ll wait for your call on this. If you think a README fallback is the better approach, I’m happy to implement that.
Glad to contribute either way.

[mootari]

Wouldn't it be preferable to keep the description consistent with the one shown in search results?

My instinct would even be to not apply any sanitization whatsoever in order to not mask any issues, so that folks might be encouraged to file issues against the respective packages (and perhaps against npm for its poor fallback).

[gameroman]

Wouldn't it be preferable to keep the description consistent with the one shown in search results?

What I'm suggesting that in search/user pages, when there is no description field set, it shows a preview of a readme

On the package page itself it would just say "No description provided", since the text is already available in the readme on the same page

My instinct would even be to not apply any sanitization whatsoever in order to not mask any issues, so that folks might be encouraged to file issues against the respective packages (and perhaps against npm for its poor fallback).

Sanitization is needed to strip off badges and other stuff from readme if we decide to keep the preview on search/user pages

It's not sanitization for the description field itself

[mootari]

it shows a preview of a readme

How though? As far as I'm aware the readme isn't included in the result payloads?

It's not sanitization for the description field itself

That's what I was referring to though. I haven't looked through the source yet but I assume that there's some sanitization happening because the actual description contains even more markup: https://registry.npmjs.com/vue-tsc/latest

[gameroman]

Ah, looks like it's npm itself that sets "description" in the packument to a stripped part of readme, when description field is not in the package.json

[gameroman]

In that case I think we can merge #3182 for now and discuss this in a new issue