Repository navigation
fix(html): decode character references in static attribute values - #4258
Conversation
Static attribute strings went from the tokenizer to setAttribute and to component props as raw text, so `placeholder="Search…"` showed `…` and an href with `&` kept it in the URL. Text children were already decoded. Decode each static prop once, when the template is built, with the HTML parser's quoted-attribute rules, so `®ion=` in a URL is left alone.
🦋 Changeset detectedLatest commit: 6e73f29 The changes in this PR will be included in the next version bump. This PR includes changesets to release 15 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Merging this PR will degrade performance by 13.37%2 warnings
Warning Please fix the performance issues or acknowledge them on CodSpeed. Performance Changes
Tip Investigate this regression by commenting Comparing Footnotes
|
Summary
Static attribute strings in
htmltemplates reachsetAttributeand component props without entity decoding. For example:<input placeholder="Search…" />showsSearch….<a href="/search?q=1&page=2">links to?q=1&page=2.<${Comp} title="a & b" />passes"a & b".Text children in the same template are already decoded, plain HTML decodes these, and the 1.x
htmlruntime decoded element attributes. Compiled JSX also decodes static attribute strings (see #1553, #3127).This decodes each static prop once, when the template is built, using the HTML parser's quoted-attribute rules, so
®ion=in a URL stays as written. It applies to attributes baked into the template, props after a spread, and component props.How did you test this change?
packages/html/test/tagged-jsx.test.ts. Onnextit fails withReceived: "/search?q=1&page=2®ion=eu", and it passes with the fix.pnpm exec vitest runinpackages/html: 4 files, 209 tests pass.tsc --project ./tsconfig.json --noEmitinpackages/htmlandprettier --checkon the changed files: clean.