Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Fizz] escape <style> textContent as css #28870

Merged
merged 1 commit into from
Apr 19, 2024
Merged

[Fizz] escape <style> textContent as css #28870

merged 1 commit into from
Apr 19, 2024

Commits on Apr 18, 2024

  1. [Fizz] escape <style> textContent as css 

    style text content has historically been escaped as HTML which is non-sensical and often leads users to using dangerouslySetInnerHTML as a matter of course. While rendering untrusted style rules is a security risk React doesn't really provide any special protection here and forcing users to use a completely unescaped API is if anything worse. So this PR updates the style escaping rules for Fizz to only escape the text content to ensure the tag scope cannot be closed early. This is accomplished by encoding "s" and "S" as hexadecimal unicode representation "\73 " and "\53 " respectively when found within a sequence like </style>. We have to be careful to support casing here just like with the script closing tag regex for bootstrap scripts.
    @gnoff
    gnoff committed Apr 18, 2024
    Configuration menu
    Copy the full SHA
    a61a35d View commit details
    Browse the repository at this point in the history