Skip to content

fix: use <br/> line breaks in boundary and Lambda labels - #380

Closed
markthomaschurch wants to merge 3 commits into
OWASP:masterfrom
markthomaschurch:fix/boundary-label-newlines
Closed

markthomaschurch wants to merge 3 commits into
OWASP:masterfrom
markthomaschurch:fix/boundary-label-newlines

Conversation

@markthomaschurch

@markthomaschurch markthomaschurch commented Nov 9, 2026 •

Copy link
Copy Markdown
Contributor

Fixes #379

Summary

Long names were drawn with a literal \n (e.g. University of\nMichigan) for the two element types that use Graphviz HTML-like labels, boundaries and Lambda, because HTML-like labels need <br/> for line breaks.

Changes

  • pytm/element.py:
    • New Element._label_lines() returns the wrapped display name. _label() uses it, and its output is unchanged.
    • New Element._html_label() HTML-escapes each line (keeping the escaping from fix: escape boundary labels in DFD output #360) and joins the lines with <br/>.
  • pytm/boundary.py: Boundary.dfd() uses _html_label().
  • pytm/asset.py: Lambda.dfd() uses _html_label(). Lambda names were not HTML-escaped before, so a < or & in one also produced an invalid label.
  • tests/test_pytmfunc.py: regression tests for a long boundary name and a long Lambda name that contain <, > and &.

Testing

  • The new tests fail on master and pass with this change.
  • Full suite: pytest tests → 263 passed. The existing dfd.dot golden files are unchanged, because their names are short.
  • Checked by hand: rendered models with nested, long-named boundaries and a long-named Lambda through dot -Tsvg. Titles now wrap onto separate lines, and no literal \n remains.

🤖 Generated with Claude Code

Boundary names are wrapped at 18 characters and joined with "\n", like
other element labels. Boundaries use Graphviz HTML-like labels
(label = <<i>...</i>>), which do not interpret "\n", so long boundary
names were drawn with a literal "\n" in the diagram.

Add Element._label_lines() so the wrapping rule is shared, and have
Boundary build its HTML label by escaping each line and joining with
<br/>.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Lambda is the other element drawn with a Graphviz HTML-like label
(<table><tr><td><b>...</b></td></tr></table>), so long Lambda names had
the same literal "\n" problem as boundaries, and "<" or "&" in a Lambda
name produced an invalid label.

Move _html_label() from Boundary to Element and use it for Lambda.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@markthomaschurch markthomaschurch changed the title fix: use <br/> line breaks in boundary labels fix: use <br/> line breaks in boundary and Lambda labels Nov 9, 2026
@markthomaschurch

Copy link
Copy Markdown
Contributor Author

Pushed one more commit: 48e05ca, "fix: use
line breaks in Lambda labels too".

Lambda is the only other element drawn with a Graphviz HTML-like label (<table><tr><td><b>…</b></td></tr></table>), so it had the same problem. Lambda("Very Long Serverless Function Name") rendered as Very Long\nServerless\nFunction Name. A < or & in a Lambda name also produced an invalid label, because Lambda labels weren't HTML-escaped (the same issue #360 fixed for boundaries).

The commit moves _html_label() from Boundary up to Element, uses it for Lambda, and adds a regression test. Full suite: 263 passed.

@izar

izar commented Nov 11, 2026

Copy link
Copy Markdown
Collaborator

Will merge #384 instead.

@izar izar closed this Nov 11, 2026
izar added a commit that referenced this pull request Nov 11, 2026
…#384)

Fixes #383

> **Depends on #380.** This branch is built on top of #380, because it
changes the same label code (`Element._label_lines()`). Until #380 is
merged, its two commits also appear here. The change specific to this PR
is the last commit, d158420.

## Summary

Names containing `"` or `\` broke both diagram types:
- **DFD:** `dot` failed with a syntax error, and backslash sequences
were read as Graphviz escapes.
- **Sequence diagram:** PlantUML turned `\n`/`\t` into a newline and a
tab, and a trailing `\` swallowed `@enduml`, so no diagram was produced.

## Changes

- `pytm/element.py`: new `dot_escape()` doubles `\` and escapes `"`.
`Element._label()` applies it to each wrapped line before joining with
`\n`, so pytm's own line breaks still work. This covers every quoted DOT
label: elements, dataflows (including merged responses), and the
datastore `xlabel` on `master`.
- `pytm/tm.py`: new `plantuml_escape()` writes `\` → `<U+005C>` and `"`
→ `<U+0022>`. It's applied to participant names, message text and notes
in `TM.seq()`.
- `tests/test_pytmfunc.py`: three regression tests:
  - DOT escaping.
  - DOT escaping combined with label wrapping.
  - PlantUML escaping, including that no raw backslash remains.

## Why Unicode escapes for PlantUML

I tested the options with the `plantuml/plantuml:latest` Docker image:

| Input in `as "..."` / message | Rendered |
|---|---|
| `C:\new\tmp\` | `C:` ⏎ `ew` ⇥ `mp`, and a trailing `\` breaks the
diagram |
| `C:\\new\\tmp\\` | `C:\new` ⇥ `mp\` (inconsistent) |
| `C:~\new~\tmp~\` | `C:~` ⏎ `ew~` ⇥ `mp~\` |
| `C:<U+005C>new<U+005C>tmp<U+005C>` | `C:\new\tmp\` ✓ |

## Testing

- The new tests fail on `master` and pass with this change.
- Full suite: `pytest tests` → 266 passed.
- Checked by hand: rendered a model with `"` and `\` in actor, server,
datastore, dataflow and note text:
- DFD with graphviz 2.43: before, `dot` fails with a syntax error;
after, every label renders literally.
- Sequence diagram with PlantUML (Docker image): before, "No valid
@start/@EnD found"; after, every label renders literally.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Izar Tarandach <izar@users.noreply.github.com>
@izar izar reopened this Nov 11, 2026
@izar
izar self-requested a review November 11, 2026 19:02
izar
izar previously approved these changes Nov 11, 2026
@izar
izar removed the request for review from colesmj November 11, 2026 19:24
@izar

izar commented Nov 11, 2026

Copy link
Copy Markdown
Collaborator

Closing as superseded: these changes are already on master via #384. Thanks for the fix!

@izar izar closed this Nov 11, 2026
@markthomaschurch
markthomaschurch deleted the fix/boundary-label-newlines branch November 12, 2026 15:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Long boundary names render a literal "\n" in the DFD

2 participants