Add dropping of custom scripts in AMP mode (#6830)

Drops user `<script>` tags and shows a warning in AMP mode. Right now they are only dropped in production mode and left in dev mode so the validator shows its warning since it looks like conflicting props log messages are being cleared causing them to not show. Closes: #6688
vercel · Mar 29, 2019 · 26a4eb8 · 26a4eb8
1 parent b6b0db1
commit 26a4eb8
Show file tree

Hide file tree

Showing 3 changed files with 25 additions and 0 deletions.
diff --git a/packages/next/pages/_document.js b/packages/next/pages/_document.js
@@ -186,6 +186,12 @@ export class Head extends Component {
         badProp = 'name="viewport"'
       } else if (type === 'link' && props.rel === 'canonical') {
         badProp = 'rel="canonical"'
+      } else if (type === 'script') {
+        badProp = '<script'
+        Object.keys(props).forEach(prop => {
+          badProp += ` ${prop}="${props[prop]}"`
+        })
+        badProp += '/>'
       }
 
       if (badProp) {

diff --git a/test/integration/amphtml/pages/custom-scripts.js b/test/integration/amphtml/pages/custom-scripts.js
@@ -0,0 +1,13 @@
+import Head from 'next/head'
+
+export default () => (
+  <div>
+    <Head>
+      <script src='/im-not-allowed.js' type='text/javascript' />
+      <script dangerouslySetInnerHTML={{
+        __html: `console.log("I'm not either :p")`
+      }} />
+    </Head>
+    <p>We only allow AMP scripts now</p>
+  </div>
+)
diff --git a/test/integration/amphtml/test/index.test.js b/test/integration/amphtml/test/index.test.js
@@ -107,6 +107,12 @@ describe('AMP Usage', () => {
         'amp-boilerplate'
       ])
     })
+
+    it('should drop custom scripts', async () => {
+      const html = await renderViaHTTP(appPort, '/custom-scripts')
+      expect(html).not.toMatch(/src='\/im-not-allowed\.js'/)
+      expect(html).not.toMatch(/console\.log("I'm not either :p")'/)
+    })
   })
 
   describe('With AMP context', () => {