Fix markdown remote SVG image loading by lawrencecchen · Pull Request #4533 · manaflow-ai/cmux

lawrencecchen · 2026-05-22T04:31:11Z

Summary

Allow consented markdown remote images with image/svg+xml MIME type.
Include SVG in the pinned remote-image Accept header.
Add regression coverage for SVG badge MIME and request headers.

Testing

Focused local xcodebuild attempts were interrupted because SwiftBuild was queued behind other local builds before the test executed.
PR CI and tagged reload are next.

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}

Note

Medium Risk
Expands the set of remotely fetched/accepted image MIME types to include SVG, which changes what untrusted content can be rendered and could introduce new parsing/rendering edge cases. Scope is small and covered by targeted regression tests.

Overview
Fixes markdown remote image loading to support SVG: the pinned remote-image request Accept header now includes image/svg+xml, and MarkdownRemoteImageSecurity.canonicalImageMIMEType recognizes/normalizes image/svg+xml (including ;charset variants).

Updates tests to assert SVG MIME canonicalization and to verify the generated request headers include the new Accept entry (including an IPv6 host request case).

^{Reviewed by Cursor Bugbot for commit 2d762ce. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by cubic

Enables consented Markdown remote SVG images by adding image/svg+xml to the Accept header and treating it as a valid image type. Keeps AVIF preferred.

Bug Fixes
- Added image/svg+xml;q=0.9 to the Accept header while preserving image/avif;q=0.9 priority.
- Canonicalized image/svg+xml (including ;charset variants) and pinned the exact Accept header string in tests.

^{Written for commit 2d762ce. Summary will update on new commits. Review in cubic}

Summary by CodeRabbit

New Features
- Remote image loading now supports SVG: requests advertise SVG in accepted MIME types and SVG responses are recognized and normalized so they are treated as allowed image formats.
Tests
- Test coverage updated to validate SVG MIME handling in requests and responses, including charset variations and request header assertions.

…mage-load

chatgpt-codex-connector · 2026-05-22T04:31:16Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

vercel · 2026-05-22T04:31:17Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
cmux	Ready	Preview, Comment	May 22, 2026 5:10am
cmux-staging	Building	Preview, Comment	May 22, 2026 5:10am

coderabbitai · 2026-05-22T04:31:26Z

📝 Walkthrough

Walkthrough

Adds image/svg+xml;q=0.9 to the remote image Accept header and updates MIME canonicalization to recognize and normalize image/svg+xml (including charset variants); tests updated to assert these behaviors.

Changes

SVG Image Support

Layer / File(s)	Summary
SVG header and MIME canonicalization `Sources/Panels/MarkdownRemoteImageLoader.swift`	Accept header updated to include `image/svg+xml;q=0.9`. `canonicalImageMIMEType` recognizes `image/svg+xml` and normalizes variants like `;charset=utf-8` to `image/svg+xml`.
SVG support test coverage `cmuxTests/MarkdownPanelTests.swift`	Test updated to expect `image/svg+xml` (and `image/svg+xml;charset=utf-8`) canonicalize to `image/svg+xml`. IPv6 request generation test now asserts the request payload includes `image/svg+xml`.

Sequence Diagram

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

manaflow-ai/cmux#4288: Overlapping changes related to accepting image/svg+xml in remote-image MIME handling and test adjustments.

Poem

🐰 I nibble headers, nibble types,
Now SVGs hop into sight,
Requests ask kindly, servers send,
Charset trimmed, the render's friend. ✨

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

Ignore

❌ Failed checks (2 errors, 2 warnings)

Check name	Status	Explanation	Resolution
Cmux Swift Blocking Runtime	❌ Error	New production file introduces NSLock (manual sync) and DispatchQueue.asyncAfter (15s timeout) in Sources/Panels/MarkdownRemoteImageLoader.swift, violating swift-blocking-runtime rule.	Use actors for state management instead of NSLock; replace asyncAfter with cancellation callback or async timeout abstraction.
Cmux Swift `@Concurrent`	❌ Error	Network-heavy async functions added without `@concurrent`. MarkdownRemoteImageFetcher.fetch() performs HTTPS I/O but lacks `@concurrent` annotation required by rule for network-heavy helpers.	Add `@concurrent` to MarkdownRemoteImageFetcher.fetch() and helper to indicate actor hop for network operations.
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Description check	⚠️ Warning	The PR description covers the main changes and testing approach, but is missing several required template sections.	Add the missing sections: Demo Video (with URL or note if not applicable), Review Trigger block, and complete Checklist with actual status indicators for each item.

✅ Passed checks (13 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'Fix markdown remote SVG image loading' clearly and concisely summarizes the main change—enabling SVG image support in markdown remote image loading.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Cmux Swift Actor Isolation	✅ Passed	Changes only modify pure static utility functions in MarkdownRemoteImageSecurity enum. No implicit MainActor values, mutable Sendable types, or UI-bound background access introduced.
Cmux No Hacky Sleeps	✅ Passed	PR changes only Swift files. Check applies only to TypeScript, JavaScript, shell, or build/runtime scripts; Swift is explicitly excluded.
Cmux Swift Concurrency	✅ Passed	PR only changes HTTP header strings and MIME switch cases; no new or expanded legacy async patterns introduced.
Cmux Swift File And Package Boundaries	✅ Passed	Minor focused changes (+3/-1) to existing 650-line file to support SVG images in remote markdown, with test updates. Fits "existing oversized files touched incidentally" exception.
Cmux Swift Logging	✅ Passed	No logging violations found. PR only modifies Accept header and MIME canonicalization for SVG support; contains no print/debugPrint/dump/NSLog statements.
Cmux User-Facing Error Privacy	✅ Passed	PR contains no user-facing error messages, alerts, or output. HTTP header and MIME canonicalization changes are internal; SVG is a standard MIME type. Tests are developer-only.
Cmux Full Internationalization	✅ Passed	All production code changes add only HTTP protocol headers and MIME type identifiers, which are literal tokens exempt from localization per the rules. Tests pass automatically.
Cmux Swiftui State Layout	✅ Passed	Changes are to networking code only (MarkdownRemoteImageLoader.swift and tests) with no SwiftUI imports, state decorators, or layout patterns. Check not applicable.
Cmux Architecture Rethink	✅ Passed	PR adds SVG MIME support via small correctness fixes without introducing timing/blocking/observer patterns. Problematic patterns pre-existed; PR only modifies MIME handling.
Cmux Swift Auxiliary Window Close Shortcuts	✅ Passed	PR adds test-only NSWindow fixtures in unit tests for markdown rendering, which are explicitly allowed by the rule. No user-visible windows or new standalone cmux windows added.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch issue-readme-remote-image-load

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 098a304. Configure here.}

greptile-apps · 2026-05-22T04:34:08Z

Greptile Summary

This PR fixes remote SVG image loading in the Markdown viewer by adding image/svg+xml to the Accept header and recognizing it as a valid canonical MIME type (including ;charset variants). The changes are small and targeted, and the previous concerns raised about the Accept header and test coverage are both addressed in this commit.

image/avif;q=0.9 correctly retains its own qualifier in the updated header, and the new test assertion validates the exact Accept header string end-to-end.
SVG data is served back through the WKWebView URL scheme handler as an <img> resource, which means WebKit sandboxes script execution — the XSS surface added here is negligible.

Confidence Score: 5/5

Safe to merge — the changes are minimal, correctly structured, and the new exact-match assertion on the Accept header guards against the content-negotiation regression raised in prior review.

The Accept header change correctly keeps image/avif;q=0.9 with its own qualifier and adds image/svg+xml;q=0.9 after it. The canonicalization switch is a straightforward passthrough. SVG is served via WKWebView's URL scheme handler as an img response, which sandboxes script execution. The new test asserts the exact Accept header string, providing solid regression coverage for content-negotiation ordering.

No files require special attention.

Important Files Changed

Filename	Overview
Sources/Panels/MarkdownRemoteImageLoader.swift	Adds image/svg+xml;q=0.9 to the Accept header and image/svg+xml canonicalization — both changes are correct and minimal.
cmuxTests/MarkdownPanelTests.swift	Updates SVG MIME assertion from XCTAssertNil to XCTAssertEqual, adds charset-variant test, and adds an exact Accept header equality check that covers the prior q-value regression concern.

_{Reviews (3): Last reviewed commit: "test: pin remote image accept header" | Re-trigger Greptile}

cubic-dev-ai

No issues found across 2 files

_{Re-trigger cubic}

lawrencecchen added 3 commits May 21, 2026 21:25

test: cover markdown remote svg images

2952431

fix: load markdown remote svg images

8029f1b

Merge remote-tracking branch 'origin/main' into issue-readme-remote-i…

098a304

…mage-load

cursor Bot reviewed May 22, 2026

View reviewed changes

Comment thread Sources/Panels/MarkdownRemoteImageLoader.swift Outdated

fix: preserve remote image avif preference

f9b8583

greptile-apps Bot reviewed May 22, 2026

View reviewed changes

Comment thread Sources/Panels/MarkdownRemoteImageLoader.swift Outdated

Comment thread cmuxTests/MarkdownPanelTests.swift Outdated

cubic-dev-ai Bot reviewed May 22, 2026

View reviewed changes

coderabbitai Bot approved these changes May 22, 2026

View reviewed changes

vercel Bot deployed to Preview – cmux May 22, 2026 04:42 View deployment

test: pin remote image accept header

2d762ce

vercel Bot deployed to Preview – cmux May 22, 2026 05:10 View deployment

lawrencecchen merged commit 7344530 into main May 22, 2026
21 checks passed

lawrencecchen deleted the issue-readme-remote-image-load branch May 22, 2026 10:44

Navigation Menu

Repository navigation

Fix markdown remote SVG image loading - #4533

Fix markdown remote SVG image loading#4533
lawrencecchen merged 5 commits into
mainfrom
issue-readme-remote-image-load

lawrencecchen commented May 22, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

chatgpt-codex-connector Bot commented May 22, 2026

Uh oh!

vercel Bot commented May 22, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented May 22, 2026 •

edited

Loading

Walkthrough

Changes

Sequence Diagram

Estimated code review effort

Possibly related PRs

Poem

Pre-merge checks failed

Uh oh!

cursor Bot left a comment

Uh oh!

Uh oh!

greptile-apps Bot commented May 22, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

lawrencecchen commented May 22, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by cubic

Summary by CodeRabbit

Uh oh!

chatgpt-codex-connector Bot commented May 22, 2026

Uh oh!

vercel Bot commented May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram

Estimated code review effort

Possibly related PRs

Poem

Pre-merge checks failed

❌ Failed checks (2 errors, 2 warnings)

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

greptile-apps Bot commented May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

lawrencecchen commented May 22, 2026 •

edited by coderabbitai Bot

Loading

vercel Bot commented May 22, 2026 •

edited

Loading

coderabbitai Bot commented May 22, 2026 •

edited

Loading

greptile-apps Bot commented May 22, 2026 •

edited

Loading