WebReflection / WebReflection/linkedom
Text escaping of $& becomes ><
Nobody has claimed this yet.
- Dominant language
- HTML
- Stars
- 2.1k
- Forks
- 104
- PR merge metrics
- No merged PRs in 30d
Description
Hello!
I think I have found a slight issue with how text is escaped. using this code:
import { parseHTML } from "https://esm.sh/linkedom"
const { document } = parseHTML('')
document.appendChild(document.createElement('script'))
document.querySelector("script").textContent = 'var $=1;$&&true'
console.log(document.toString())
logs <script>var $=1;><&true</script> as output. $& has been replaced by ><.
If I run similar code in a browser I get <script>var $=1;$&&true</script>. The code I ran in the browser is
var doc = document.createDocumentFragment()
doc.appendChild(document.createElement('script'))
doc.querySelector("script").textContent = 'var $=1;$&&true';
console.log(doc.querySelector("script").outerHTML)
This is a bit problematic for me since it means that inlineing my JS after SSR produces invalid code which will not run.
I have tested it in deno (v1.24.3), node (v18.2.0) and bun.sh (v0.1.11) so I don't think it's anything platform specific.
Thanks!
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the parseHTML, script element, textContent, and document.toString() paths shown in the reproduction. Compare the serialized result with the browser output for the value var $=1;$&&true. Done means serializing the script preserves $&& as text so inline SSR JavaScript remains valid.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- web-dev
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100