`<style>` and `<script>` children inside MathML are not escaped in SSR (and static DOM templates), allowing markup injection

Abierto
  • ¿Algo no está bien?
#4,704 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

@santhiprakash ya está trabajando en esto.

Desde el 7/11/2026.

  • #598 de @santhiprakash — abierto

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
68/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
javascript, typescript
Área
frontend, security

Línea de trabajo

Start in packages/babel-plugin-jsx-dom-expressions/src/shared/utils.js at isRawTextElement(path) and read the existing SVG handling and related tests. Reproduce the MathML case in both SSR and static DOM template generation, including the noted integration points. Done means dynamic children are escaped in those cases while the reported SVG behavior remains correct.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

In solid-js 1.9.18 (babel-preset-solid 1.9.16 / babel-plugin-jsx-dom-expressions 0.40.11, Node v24.14.1), renderToString (compiled with generate: "ssr") and static DOM templates (generate: "dom") treat <style> and <script> children inside MathML (<math>) as raw text (doNotEscape), omitting HTML escaping of < and & and allowing dynamic text children to break out of <style>/<script> and <math> to inject arbitrary HTML markup.

// Compiled with babel-preset-solid { generate: "ssr" }
import { renderToString } from "solid-js/web";

const MathStyle = (props) => <math><style>{props.x}</style></math>;
const MathScript = (props) => <math><script>{props.x}</script></math>;
const SvgStyle = (props) => <svg><style>{props.x}</style></svg>;

console.log(renderToString(() => <MathStyle x="</style><b>x</b>" />));
console.log(renderToString(() => <MathScript x="</script><b>x</b>" />));
console.log(renderToString(() => <SvgStyle x="</style><b>x</b>" />));

Expected:

<math><style>&lt;/style>&lt;b>x&lt;/b></style></math>
<math><script>&lt;/script>&lt;b>x&lt;/b></script></math>
<svg><style>&lt;/style>&lt;b>x&lt;/b></style></svg>

Actual:

<math><style></style><b>x</b></style></math>
<math><script></script><b>x</b></script></math>
<svg><style>&lt;/style>&lt;b>x&lt;/b></style></svg>

Per the WHATWG HTML parsing specification (§13.2.5.54 / §13.2.6.5), <script> and <style> only switch the tokenizer into rawtext/script data states in the HTML namespace; inside foreign content (both SVG and MathML), they remain in the normal data state where < and & are parsed as markup and character references.

In packages/babel-plugin-jsx-dom-expressions/src/shared/utils.js, isRawTextElement(path) checks for <svg> and SVGElements (added in ryansolid/dom-expressions#590) to keep SVG <style>/<script> children escaped, but does not check <math> or MathML elements (nor MathML HTML/MathML integration points like <annotation-xml>), so MathML falls through to doNotEscape = true. (Relatedly, for HTML <style>{props.x}</style>, dynamic children are emitted verbatim without neutralizing closing </style>/</script> sequences.)

Credit: https://ucsbplse.github.io/

Lenguaje dominante
TypeScript
Estrellas
36.2k
Forks
1.1k
Merge medio
9 h
PR fusionados (30 d)
463

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de solidjs/solid

Todos los issues de solidjs/solid

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.