WebReflection / WebReflection/linkedom

Text escaping of $& becomes ><

Open
#158 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
HTML
Stars
2.1k
Forks
104
PR merge metrics
No merged PRs in 30d

Description

Hello!

I think I have found a slight issue with how text is escaped. using this code:

import { parseHTML } from "https://esm.sh/linkedom"
const { document } = parseHTML('')
document.appendChild(document.createElement('script'))
document.querySelector("script").textContent = 'var $=1;$&&true'
console.log(document.toString())

logs <script>var $=1;><&true</script> as output. $& has been replaced by ><.

If I run similar code in a browser I get <script>var $=1;$&&true</script>. The code I ran in the browser is

var doc = document.createDocumentFragment()
doc.appendChild(document.createElement('script'))
doc.querySelector("script").textContent = 'var $=1;$&&true';
console.log(doc.querySelector("script").outerHTML)

This is a bit problematic for me since it means that inlineing my JS after SSR produces invalid code which will not run.

I have tested it in deno (v1.24.3), node (v18.2.0) and bun.sh (v0.1.11) so I don't think it's anything platform specific.

Thanks!

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the parseHTML, script element, textContent, and document.toString() paths shown in the reproduction. Compare the serialized result with the browser output for the value var $=1;$&&true. Done means serializing the script preserves $&& as text so inline SSR JavaScript remains valid.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
web-dev
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.