preact-render-to-string icon indicating copy to clipboard operation
preact-render-to-string copied to clipboard
verified publisher icon preactjs

fix: escape a single quote

Open yusukebe opened this issue 2 years ago • 3 comments

Hi,

Firstly, thank you for the great project.

In this PR, I've implemented the escaping of a single quote (0x27) to '. This modification will prevent the potential execution of scripts, as illustrated below:

const value = "alert('bar!')";
return <div onMouseOver={value}>foo</div>;

yusukebe avatar Aug 13 '23 01:08 yusukebe

🦋 Changeset detected

Latest commit: 345fcc7ba96a0bfd67a4172a4b2f55f15834a871

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
preact-render-to-string Major

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

changeset-bot[bot] avatar Aug 13 '23 01:08 changeset-bot[bot]

FYI: This is a breaking change. A a good chunk of users from the Fresh framework depend on this working.

marvinhagemeister avatar Aug 15 '23 11:08 marvinhagemeister

Hi @marvinhagemeister,

I'm aware that Preact is used for Fresh, and I a fan of it. Indeed, this change introduces a breaking change that could have a significant impact. I believe it would be best to include this change when this package is released with a major version upgrade.

yusukebe avatar Aug 15 '23 13:08 yusukebe