airbnb/hypernova

Encode closing Tag

Open

#165 geöffnet am 9. Okt. 2019

Auf GitHub ansehen
 (8 Kommentare) (4 Reaktionen) (0 zugewiesene Personen)JavaScript (5.831 Stars) (249 Forks)batch import
bughelp wanted

Beschreibung

Currently encoding in the index.js only includes

const ENCODE = [
  ['&', '&'],
  ['>', '>'],
];

If a component is being rendered SSR and includes a property with a closing script tag, the script tag in the SSrendered HTML will close the hypernova script.

<script type="application/json" data-hypernova-key="App" data-hypernova-id="....">
   <!-- {"props": ..., "title":"</script "} 

which will throw an error in the JSON.parse method of the payload.

is there a reason closing tags are not encoded here ? Following changes would suffice:

var ENCODE = [
['&', '&amp;'],
['>', '&gt;'],
['<', '&lt;']
];

Contributor Guide