dnrops
/
leptos
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: escape `</script>` and other HTML tags in serialized resources

This commit is contained in:
Greg Johnston 2023-03-28 20:34:54 -04:00
parent e6b1298915
commit b0f745f4a9
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
leptos_dom/src/ssr.rs
View File

@ -509,12 +509,14 @@ pub(crate) fn render_serializers(
) -> impl Stream<Item = String> {
serializers.map(|(id, json)| {
let id = serde_json::to_string(&id).unwrap();
let json = json.replace('<', "\\u003c");
format!(
r#"<script>
var val = {json:?};
if(__LEPTOS_RESOURCE_RESOLVERS.get({id})) {{
__LEPTOS_RESOURCE_RESOLVERS.get({id})({json:?})
__LEPTOS_RESOURCE_RESOLVERS.get({id})(val)
}} else {{
__LEPTOS_RESOLVED_RESOURCES.set({id}, {json:?});
__LEPTOS_RESOLVED_RESOURCES.set({id}, val);
}}
</script>"#,
)