aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDanilo M. <danix@danix.xyz>2026-08-07 19:18:12 +0200
committerDanilo M. <danix@danix.xyz>2026-08-07 19:18:12 +0200
commit03f113dc0f6e8db13f600f2650e1536f4c09da21 (patch)
treec216267719cf4cabed13e5f9b11f533108abffd0
parent01194fa2c48019f1dcbdfefac94f8fd5f8e38122 (diff)
downloadqtmaildir-03f113dc0f6e8db13f600f2650e1536f4c09da21.tar.gz
qtmaildir-03f113dc0f6e8db13f600f2650e1536f4c09da21.zip
docs: record that QString::arg does not collapse %% into %
printf does, and the habit transfers silently. In generated CSS it is quietly destructive: a percentage written %% reaches the browser malformed, and a browser drops that one declaration and renders the rest, so the pane still paints and nothing looks broken. The 0.11.0 placeholder lost its mask, its glow and both radial gradients this way. Records the review lesson alongside it, which generalizes further than the rule: a geometry probe endorsed that layout because it measured only properties carrying no percentage. A probe that cannot see the thing that breaks reports success forever. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
-rw-r--r--CLAUDE.md13
1 files changed, 13 insertions, 0 deletions
diff --git a/CLAUDE.md b/CLAUDE.md
index 2a9bdb9..1ebb407 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -195,6 +195,19 @@ configured **Bold** in qt6ct, so every row rendered bold and `setBold(true)` cha
nothing. Before concluding a Qt facility is broken, check the desktop's own font and theme
configuration.
+**`QString::arg()` does not collapse `%%` into `%`.** `printf` does, and the habit
+transfers silently. In generated CSS this is quietly destructive: every percentage written
+`%%` to escape it reaches the browser malformed, and a browser does not report a bad
+declaration, it **drops that one rule and renders the rest**. The 0.11.0 placeholder lost
+its mask, its glow and both radial gradients this way while still painting a plausible
+pane, so nothing looked broken. Write `%` directly; `arg()` only ever consumes `%1`..`%99`.
+
+The reason it survived review is worth more than the rule: **a geometry probe endorsed the
+layout**, because it measured only properties that carried no percentage. A probe that
+cannot see the thing that breaks will report success forever. When asserting on generated
+CSS, assert on the **generated string** as well as on the rendered result, and make sure
+the assertion covers the declarations that actually went missing.
+
## Web view security
The most security-sensitive area: a browser engine pointed at input from strangers. Do not