refactor: v2 release #6903
refactor: v2 release #6903
Conversation
🦋 Changeset detectedLatest commit: 6f98088 The changes in this PR will be included in the next version bump. This PR includes no changesetsWhen changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
commit: |
built with Refined Cloudflare Pages Action⚡ Cloudflare Pages Deployment
|
| } | ||
| errorDiv.setAttribute('q:key', '_error_'); | ||
| const journal: VNodeJournal = []; | ||
| vnode_getDOMChildNodes(journal, vHost).forEach((child) => errorDiv.appendChild(child)); |
Check warning
Code scanning / CodeQL
DOM text reinterpreted as HTML Medium
| } else if (key === 'value' && key in element) { | ||
| (element as any).value = escapeHTML(String(value)); | ||
| } else if (key === dangerouslySetInnerHTML) { | ||
| (element as any).innerHTML = value!; |
Check warning
Code scanning / CodeQL
DOM text reinterpreted as HTML Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 3 days ago
To fix the problem, we need to ensure that any text content extracted from the DOM and set as HTML is properly escaped to prevent XSS attacks. The best way to fix this is to use a function that escapes HTML special characters before setting the innerHTML property.
- We will modify the code to use the
escapeHTMLfunction before setting theinnerHTMLproperty. - Specifically, we will change the line where
dangerouslySetInnerHTMLis used to ensure the value is escaped.
| @@ -895,3 +895,3 @@ | ||
| } else if (key === dangerouslySetInnerHTML) { | ||
| (element as any).innerHTML = value!; | ||
| (element as any).innerHTML = escapeHTML(String(value!)); | ||
| } else { |
| const insertBefore = journal[idx++] as Element | Text | null; | ||
| let newChild: any; | ||
| while (idx < length && typeof (newChild = journal[idx]) !== 'number') { | ||
| insertParent.insertBefore(newChild, insertBefore); |
Check warning
Code scanning / CodeQL
DOM text reinterpreted as HTML Medium
…nd wrap with "experimental"
V2 merge main
Co-authored-by: Jack Shelton <thejackshelton@users.noreply.github.com> Co-authored-by: Maïeul <maiieul@users.noreply.github.com> Co-authored-by: Wout Mertens <Wout.Mertens@gmail.com>
fix(slots): get the right component frame while processing slots
Co-authored-by: Wout Mertens <Wout.Mertens@gmail.com>
fix(render): fix inline component rendering
V2 Version Packages (alpha)
fix permissions for tagging v2 with latest
chore: merge main into v2 + fixups
fix: docs build command
fix(signals): schedule signal computation and run effects through the scheduler
refactor: v2 errors
V2 Version Packages (alpha)
fix: repl tabs
This PR is for showing progress on v2, and having installable npm packages.
DO NOT MERGE
The changes are meant to be readable and maintainable, so if things are unclear please let us know.