You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Loading the page will display the alert, as the <script> tag content is not properly espaced
Expected behavior
I expect content provided to solid-js tags to be properly escaped
Content provided to div tags (and others) is properly escaped: <div>{"<b>test</b>"}</div>
Content provided to title and script tags (and probably other <head> tags) is not properly escaped
Activity
ryansolid commentedon Apr 2, 2023
Fixed in Solid Meta 0.28.3
benoitv-code commentedon Apr 2, 2023
Thanks! Looking at the fix, I don't think the second example is handled (
<script type="application/json">).Is it the user's responsibility to escape
<script>tags?(example of such escape: https://github.com/vercel/next.js/blob/2abc824869e4927b820767c1c416a381c8ae528d/packages/next/src/server/htmlescape.ts)
(cc @ryansolid @sirenkovladd)
lxsmnsyc commentedon Apr 2, 2023
@benoitv-code You can use
innerHTMLprop