airbnb/hypernova

Encode closing Tag

开放

#165 创建于 2019年10月9日

 (8 条评论) (4 个反应) (0 位负责人)JavaScript (216 个派生)batch import
bughelp wanted

仓库指标

星标
 (5,784 个星标)
PR 合并指标
 (PR 指标待抓取)

描述

Currently encoding in the index.js only includes

const ENCODE = [
  ['&', '&'],
  ['>', '>'],
];

If a component is being rendered SSR and includes a property with a closing script tag, the script tag in the SSrendered HTML will close the hypernova script.

<script type="application/json" data-hypernova-key="App" data-hypernova-id="....">
   <!-- {"props": ..., "title":"</script "} 

which will throw an error in the JSON.parse method of the payload.

is there a reason closing tags are not encoded here ? Following changes would suffice:

var ENCODE = [
['&', '&amp;'],
['>', '&gt;'],
['<', '&lt;']
];

贡献者指南