refactor: v2 release #6903
refactor: v2 release #6903
Conversation
🦋 Changeset detectedLatest commit: c029c32 The changes in this PR will be included in the next version bump. This PR includes changesets to release 5 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
commit: |
built with Refined Cloudflare Pages Action⚡ Cloudflare Pages Deployment
|
| } | ||
| errorDiv.setAttribute('q:key', '_error_'); | ||
| const journal: VNodeJournal = []; | ||
| vnode_getDOMChildNodes(journal, vHost).forEach((child) => errorDiv.appendChild(child)); |
Check warning
Code scanning / CodeQL
DOM text reinterpreted as HTML Medium
| } else if (key === 'value' && key in element) { | ||
| (element as any).value = escapeHTML(String(value)); | ||
| } else if (key === dangerouslySetInnerHTML) { | ||
| (element as any).innerHTML = value!; |
Check warning
Code scanning / CodeQL
DOM text reinterpreted as HTML Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 10 days ago
To fix the problem, we need to ensure that any text content extracted from the DOM and set as HTML is properly escaped to prevent XSS attacks. The best way to fix this is to use a function that escapes HTML special characters before setting the innerHTML property.
- We will modify the code to use the
escapeHTMLfunction before setting theinnerHTMLproperty. - Specifically, we will change the line where
dangerouslySetInnerHTMLis used to ensure the value is escaped.
| @@ -895,3 +895,3 @@ | ||
| } else if (key === dangerouslySetInnerHTML) { | ||
| (element as any).innerHTML = value!; | ||
| (element as any).innerHTML = escapeHTML(String(value!)); | ||
| } else { |
| const insertBefore = journal[idx++] as Element | Text | null; | ||
| let newChild: any; | ||
| while (idx < length && typeof (newChild = journal[idx]) !== 'number') { | ||
| insertParent.insertBefore(newChild, insertBefore); |
Check warning
Code scanning / CodeQL
DOM text reinterpreted as HTML Medium
Co-authored-by: Wout Mertens <[email protected]>
fix(render): fix inline component rendering
Co-authored-by: Wout Mertens <[email protected]>
chore(v2): merge main into build/v2
fix(signals): should early resolve computed qrl
chore: merge main and fix build
* fix component rendering * revert doc search key changes
fix: docs build command
fix(signals): schedule signal computation and run effects through the scheduler
refactor: v2 errors
V2 Version Packages (alpha)
fix: repl tabs
fix: convert destructured string prop to props variable
Co-authored-by: Steff <[email protected]>
fix: destructured props for inline components
fix: serialize var prop
fix: updating signal-based var props
fix: textarea with null value
This PR is for showing progress on v2, and having installable npm packages.
DO NOT MERGE
The changes are meant to be readable and maintainable, so if things are unclear please let us know.