airbnb/hypernova

Encode closing Tag

Open

#165 aberto em 9 de out. de 2019

Ver no GitHub
 (8 comments) (4 reactions) (0 assignees)JavaScript (249 forks)batch import
bughelp wanted

Métricas do repositório

Stars
 (5.831 stars)
Métricas de merge de PR
 (Nenhuma PRs mesclada em 30d)

Description

Currently encoding in the index.js only includes

const ENCODE = [
  ['&', '&'],
  ['>', '>'],
];

If a component is being rendered SSR and includes a property with a closing script tag, the script tag in the SSrendered HTML will close the hypernova script.

<script type="application/json" data-hypernova-key="App" data-hypernova-id="....">
   <!-- {"props": ..., "title":"</script "} 

which will throw an error in the JSON.parse method of the payload.

is there a reason closing tags are not encoded here ? Following changes would suffice:

var ENCODE = [
['&', '&amp;'],
['>', '&gt;'],
['<', '&lt;']
];

Guia do colaborador