refactor: v2 release #6903
refactor: v2 release #6903
Conversation
🦋 Changeset detectedLatest commit: 9849dcf The changes in this PR will be included in the next version bump. Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
commit: |
built with Refined Cloudflare Pages Action⚡ Cloudflare Pages Deployment
|
| const insertBefore = journal[idx++] as Element | Text | null; | ||
| let newChild: any; | ||
| while (idx < length && typeof (newChild = journal[idx]) !== 'number') { | ||
| insertParent.insertBefore(newChild, insertBefore); |
Check warning
Code scanning / CodeQL
DOM text reinterpreted as HTML Medium
| c.push(`\n/** Qwik Router Entries (${entries.length}) */`); | ||
| for (let i = 0; i < entries.length; i++) { | ||
| const entry = entries[i]; | ||
| c.push(`export const ${entry.id} = () => import(${JSON.stringify(entry.filePath)});`); |
Check warning
Code scanning / CodeQL
Improper code sanitization Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 7 months ago
To fix the problem, we need to ensure that entry.filePath is properly sanitized before being used in the dynamically generated JavaScript code. We can achieve this by escaping potentially dangerous characters in the entry.filePath string. This can be done by implementing a function similar to escapeUnsafeChars from the example provided in the background section.
- Implement a function
escapeUnsafeCharsto escape potentially dangerous characters. - Use this function to sanitize
entry.filePathbefore including it in the generated code.
| @@ -2,2 +2,20 @@ | ||
|
|
||
| function escapeUnsafeChars(str: string): string { | ||
| const charMap: { [key: string]: string } = { | ||
| '<': '\\u003C', | ||
| '>': '\\u003E', | ||
| '/': '\\u002F', | ||
| '\\': '\\\\', | ||
| '\b': '\\b', | ||
| '\f': '\\f', | ||
| '\n': '\\n', | ||
| '\r': '\\r', | ||
| '\t': '\\t', | ||
| '\0': '\\0', | ||
| '\u2028': '\\u2028', | ||
| '\u2029': '\\u2029' | ||
| }; | ||
| return str.replace(/[<>\b\f\n\r\t\0\u2028\u2029]/g, x => charMap[x]); | ||
| } | ||
|
|
||
| export function createEntries(ctx: BuildContext, c: string[]) { | ||
| @@ -25,3 +43,3 @@ | ||
| const entry = entries[i]; | ||
| c.push(`export const ${entry.id} = () => import(${JSON.stringify(entry.filePath)});`); | ||
| c.push(`export const ${entry.id} = () => import(${escapeUnsafeChars(JSON.stringify(entry.filePath))});`); | ||
| } |
| } | ||
|
|
||
| if (key === dangerouslySetInnerHTML) { | ||
| element.innerHTML = value as string; |
Check warning
Code scanning / CodeQL
DOM text reinterpreted as HTML Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 18 days ago
To fix the issue, the value assigned to element.innerHTML should be sanitized using a utility function like escapeHTML to ensure that any potentially malicious content is properly escaped before being interpreted as HTML. This will prevent XSS vulnerabilities.
Steps to fix:
- Identify the assignment of
valuetoelement.innerHTMLin thevnode_difffunction. - Apply the
escapeHTMLutility tovaluebefore assigning it toinnerHTML. - Ensure that the
escapeHTMLutility is imported and available in the file.
Required changes:
- Modify the line where
element.innerHTMLis set to useescapeHTML(value as string)instead ofvalue as string.
| @@ -657,3 +657,3 @@ | ||
| if (key === dangerouslySetInnerHTML) { | ||
| element.innerHTML = value as string; | ||
| element.innerHTML = escapeHTML(value as string); | ||
| element.setAttribute(QContainerAttr, QContainerValue.HTML); |
| } else if (key === 'value' && key in element) { | ||
| (element as any).value = String(value); | ||
| } else if (key === dangerouslySetInnerHTML) { | ||
| (element as any).innerHTML = value!; |
Check warning
Code scanning / CodeQL
DOM text reinterpreted as HTML Medium
fix: custom event names and DOMContentLoaded handling
fix: reexecute component with null key
chore: merge main into v2
fix: correctly handle initial resource state
chore: reduce core production size
…te data properties
Co-authored-by: Wout Mertens <[email protected]>
feat(docs): state and html parser
feat: route loaders serialization
This PR is for showing progress on v2, and having installable npm packages.
DO NOT MERGE
The changes are meant to be readable and maintainable, so if things are unclear please let us know.