In this PR, I've implemented the escaping of a single quote (0x27) to'. This modification will prevent the potential execution of scripts, as illustrated below:

constvalue="alert('bar!')";return<divonMouseOver={value}>foo</div>;

fix: escape a single quote

7b04552

Copy link

changeset-botbot commentedAug 13, 2023•
edited
Loading

🦋 Changeset detected

Latest commit:345fcc7

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
preact-render-to-string	Major

Not sure what this means?Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

changeset

897516e

Copy link

Member

marvinhagemeister commentedAug 15, 2023

FYI: This is a breaking change. A a good chunk of users from theFresh framework depend on this working.

Copy link

Author

yusukebe commentedAug 15, 2023

Hi@marvinhagemeister,

I'm aware that Preact is used for Fresh, and I a fan of it. Indeed, this change introduces a breaking change that could have a significant impact. I believe it would be best to include this change when this package is released with a major version upgrade.

rschristian reviewed

Aug 23, 2023

View reviewed changes

.changeset/quiet-dragons-lay.md OutdatedShow resolvedHide resolved

Update .changeset/quiet-dragons-lay.md

345fcc7

Labels

None yet

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix: escape a single quote#313

Are you sure you want to change the base?

fix: escape a single quote#313

Uh oh!