Skip to content

Content of head tags not escaped properly #1665

Closed

Description

@benoitv-code

Describe the bug

Content of head tags is not escaped properly

This affects both solid-js (1.7.0) and solid-start (0.2.24)

Your Example Website or App

https://stackblitz.com/edit/github-mjp4mm-aa1k9v?file=src/routes/index.tsx

Steps to Reproduce the Bug or Issue

Example 1 (<Title>)

const Test = () => (
  <Title>{'Hello</title><script>alert("toto");</script><title> World'}</Title>
);

Loading the page will display the alert, as the <Title> tag content is not properly espaced

(same behavior with <title> from solid-js)

Example 2 (<script>)

const Test = () => (
  <script id="__CUSTOM_DATA__" type="application/json">
    {JSON.stringify({
      test: "toto</script><script>alert('toto');</script>",
    })}
  </script>
);

Loading the page will display the alert, as the <script> tag content is not properly espaced

Expected behavior

I expect content provided to solid-js tags to be properly escaped

Content provided to div tags (and others) is properly escaped: <div>{"<b>test</b>"}</div>
Content provided to title and script tags (and probably other <head> tags) is not properly escaped

Screenshots or Videos

No response

Platform

  • OS: Linux
  • Browser: Chrome
  • Version: 111.0.5563.147

Additional context

No response

Activity

  1. ryansolid commented on Apr 2, 2023

    @ryansolid
    Member

    Fixed in Solid Meta 0.28.3

  2. benoitv-code commented on Apr 2, 2023

    @benoitv-code
    Author

    Thanks! Looking at the fix, I don't think the second example is handled (<script type="application/json">).

    Is it the user's responsibility to escape <script> tags?

    (example of such escape: https://github.com/vercel/next.js/blob/2abc824869e4927b820767c1c416a381c8ae528d/packages/next/src/server/htmlescape.ts)

    (cc @ryansolid @sirenkovladd)

  3. lxsmnsyc commented on Apr 2, 2023

    @lxsmnsyc
    Member

    @benoitv-code You can use innerHTML prop

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions