airbnb/hypernova

Encode closing Tag

Open

#165 aperta il 9 ott 2019

Vedi su GitHub
 (8 commenti) (4 reazioni) (0 assegnatari)JavaScript (249 fork)batch import
bughelp wanted

Metriche repository

Star
 (5831 star)
Metriche merge PR
 (Nessuna PR mergiata in 30 g)

Descrizione

Currently encoding in the index.js only includes

const ENCODE = [
  ['&', '&'],
  ['>', '>'],
];

If a component is being rendered SSR and includes a property with a closing script tag, the script tag in the SSrendered HTML will close the hypernova script.

<script type="application/json" data-hypernova-key="App" data-hypernova-id="....">
   <!-- {"props": ..., "title":"</script "} 

which will throw an error in the JSON.parse method of the payload.

is there a reason closing tags are not encoded here ? Following changes would suffice:

var ENCODE = [
['&', '&amp;'],
['>', '&gt;'],
['<', '&lt;']
];

Guida contributor