airbnb/hypernova

Encode closing Tag

Open

#165 geöffnet am 9. Okt. 2019

Auf GitHub ansehen
 (8 Kommentare) (4 Reaktionen) (0 zugewiesene Personen)JavaScript (249 Forks)batch import
bughelp wanted

Repository-Metriken

Stars
 (5.831 Stars)
PR-Merge-Metriken
 (Keine gemergten PRs in 30 T)

Beschreibung

Currently encoding in the index.js only includes

const ENCODE = [
  ['&', '&'],
  ['>', '>'],
];

If a component is being rendered SSR and includes a property with a closing script tag, the script tag in the SSrendered HTML will close the hypernova script.

<script type="application/json" data-hypernova-key="App" data-hypernova-id="....">
   <!-- {"props": ..., "title":"</script "} 

which will throw an error in the JSON.parse method of the payload.

is there a reason closing tags are not encoded here ? Following changes would suffice:

var ENCODE = [
['&', '&amp;'],
['>', '&gt;'],
['<', '&lt;']
];

Contributor Guide