airbnb/hypernova

Encode closing Tag

Open

#165 建立於 2019年10月9日

在 GitHub 查看
 (8 留言) (4 反應) (0 負責人)JavaScript (249 fork)batch import
bughelp wanted

倉庫指標

Star
 (5,831 star)
PR 合併指標
 (30 天內沒有已合併 PR)

描述

Currently encoding in the index.js only includes

const ENCODE = [
  ['&', '&'],
  ['>', '>'],
];

If a component is being rendered SSR and includes a property with a closing script tag, the script tag in the SSrendered HTML will close the hypernova script.

<script type="application/json" data-hypernova-key="App" data-hypernova-id="....">
   <!-- {"props": ..., "title":"</script "} 

which will throw an error in the JSON.parse method of the payload.

is there a reason closing tags are not encoded here ? Following changes would suffice:

var ENCODE = [
['&', '&amp;'],
['>', '&gt;'],
['<', '&lt;']
];

貢獻者指南