airbnb/hypernova

Encode closing Tag

Aberta

#165 aberto em 9 de out. de 2019

 (8 comentários) (4 reações) (0 responsável)JavaScript (216 forks)batch import
bughelp wanted

Métricas do repositório

Stars
 (5.787 estrelas)
Métricas de merge de PR
 (Nenhuma PRs mesclada em 30d)

Description

Currently encoding in the index.js only includes

const ENCODE = [
  ['&', '&'],
  ['>', '>'],
];

If a component is being rendered SSR and includes a property with a closing script tag, the script tag in the SSrendered HTML will close the hypernova script.

<script type="application/json" data-hypernova-key="App" data-hypernova-id="....">
   <!-- {"props": ..., "title":"</script "} 

which will throw an error in the JSON.parse method of the payload.

is there a reason closing tags are not encoded here ? Following changes would suffice:

var ENCODE = [
['&', '&amp;'],
['>', '&gt;'],
['<', '&lt;']
];

Guia do colaborador