`<style>` and `<script>` children inside MathML are not escaped in SSR (and static DOM templates), allowing markup injection

Aperta
  • Qualcosa non va?
#4,704 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@santhiprakash ci sta già lavorando.

Dal 7/11/2026.

  • #598 di @santhiprakash — aperta

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
68/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
javascript, typescript
Ambito
frontend, security

Direzione di ricerca

Start in packages/babel-plugin-jsx-dom-expressions/src/shared/utils.js at isRawTextElement(path) and read the existing SVG handling and related tests. Reproduce the MathML case in both SSR and static DOM template generation, including the noted integration points. Done means dynamic children are escaped in those cases while the reported SVG behavior remains correct.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

In solid-js 1.9.18 (babel-preset-solid 1.9.16 / babel-plugin-jsx-dom-expressions 0.40.11, Node v24.14.1), renderToString (compiled with generate: "ssr") and static DOM templates (generate: "dom") treat <style> and <script> children inside MathML (<math>) as raw text (doNotEscape), omitting HTML escaping of < and & and allowing dynamic text children to break out of <style>/<script> and <math> to inject arbitrary HTML markup.

// Compiled with babel-preset-solid { generate: "ssr" }
import { renderToString } from "solid-js/web";

const MathStyle = (props) => <math><style>{props.x}</style></math>;
const MathScript = (props) => <math><script>{props.x}</script></math>;
const SvgStyle = (props) => <svg><style>{props.x}</style></svg>;

console.log(renderToString(() => <MathStyle x="</style><b>x</b>" />));
console.log(renderToString(() => <MathScript x="</script><b>x</b>" />));
console.log(renderToString(() => <SvgStyle x="</style><b>x</b>" />));

Expected:

<math><style>&lt;/style>&lt;b>x&lt;/b></style></math>
<math><script>&lt;/script>&lt;b>x&lt;/b></script></math>
<svg><style>&lt;/style>&lt;b>x&lt;/b></style></svg>

Actual:

<math><style></style><b>x</b></style></math>
<math><script></script><b>x</b></script></math>
<svg><style>&lt;/style>&lt;b>x&lt;/b></style></svg>

Per the WHATWG HTML parsing specification (§13.2.5.54 / §13.2.6.5), <script> and <style> only switch the tokenizer into rawtext/script data states in the HTML namespace; inside foreign content (both SVG and MathML), they remain in the normal data state where < and & are parsed as markup and character references.

In packages/babel-plugin-jsx-dom-expressions/src/shared/utils.js, isRawTextElement(path) checks for <svg> and SVGElements (added in ryansolid/dom-expressions#590) to keep SVG <style>/<script> children escaped, but does not check <math> or MathML elements (nor MathML HTML/MathML integration points like <annotation-xml>), so MathML falls through to doNotEscape = true. (Relatedly, for HTML <style>{props.x}</style>, dynamic children are emitted verbatim without neutralizing closing </style>/</script> sequences.)

Credit: https://ucsbplse.github.io/

Lingua principale
TypeScript
Stelle
36.2k
Fork
1.1k
Merge medio
9h
PR unite (30g)
463

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di solidjs/solid

Tutte le issue di solidjs/solid

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.