airbnb/hypernova

Encode closing Tag

Open

#165 创建于 2019年10月9日

在 GitHub 查看
 (8 评论) (4 反应) (0 负责人)JavaScript (249 fork)batch import
bughelp wanted

仓库指标

Star
 (5,831 star)
PR 合并指标
 (30 天内没有已合并 PR)

描述

Currently encoding in the index.js only includes

const ENCODE = [
  ['&', '&'],
  ['>', '>'],
];

If a component is being rendered SSR and includes a property with a closing script tag, the script tag in the SSrendered HTML will close the hypernova script.

<script type="application/json" data-hypernova-key="App" data-hypernova-id="....">
   <!-- {"props": ..., "title":"</script "} 

which will throw an error in the JSON.parse method of the payload.

is there a reason closing tags are not encoded here ? Following changes would suffice:

var ENCODE = [
['&', '&amp;'],
['>', '&gt;'],
['<', '&lt;']
];

贡献者指南