Fix escaping in ReactDOMInput code #26630
Conversation
JSON.stringify isn't the right thing here. Luckily this doesn't look to have any security impact.
facebook-github-bot
added
CLA Signed
React Core Team
|
Comparing: d121c67...a4b9f9c Critical size changesIncludes critical production bundles, as well as any change greater than 2%:
Significant size changesIncludes any change greater than 0.2%: (No significant changes) |
packages/react-dom-bindings/src/client/escapeSelectorAttributeValueInsideDoubleQuotes.js
Outdated
Show resolved
Hide resolved
jsdom's implementation of ~= is buggy (just filed dperini/nwsapi#84) -- but = is a better fit here regardless since href is not a space-separated list of values.
There was a problem hiding this comment.
Hmm I thought the space would be consumed by the escape sequence. The selector can’t change, we rely on an invariant that hrefs for float style tags and style sheet link tags do not have spaces in them. This is because we coalesce multiple style tags into a single flushed tag and use this space separated selector to look for a match.
I wouldn’t have thought the escape change would affect this, shouldn’t the new space be consumed?
|
(Thanks for looking – was going to tag you on Monday before merging.) Yes. It's a bug in the selector library used by jsdom that filed an issue for this morning: dperini/nwsapi#84. I confirmed that |
|
@gnoff thoughts? |
|
no worries! thanks for looking |
JSON.stringify isn't the right thing here. Luckily this doesn't look to have any security impact.
JSON.stringify isn't the right thing here. Luckily this doesn't look to have any security impact. DiffTrain build for commit 9ee7964.
JSON.stringify isn't the right thing here. Luckily this doesn't look to have any security impact.