Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: escape <textarea value={...}> attribute properly #8434

Merged
merged 4 commits into from Mar 30, 2023
Merged

fix: escape <textarea value={...}> attribute properly #8434

merged 4 commits into from Mar 30, 2023

Conversation

baseballyama
Copy link
Member

fix: #8429

I think this bug is added in #5701

Before submitting the PR, please make sure you do the following

  • It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs
  • Prefix your PR title with feat:, fix:, chore:, or docs:.
  • This message body should clearly illustrate what problems it solves.
  • Ideally, include a test that fails without this PR but passes with it.

Tests

  • Run the tests with npm test and lint the project with npm run lint

@vercel
Copy link

vercel bot commented Mar 30, 2023

@baseballyama is attempting to deploy a commit to the Svelte Team on Vercel.

A member of the Team first needs to authorize it.

@Conduitry
Copy link
Member

Is this the right fix? Since we're serializing the value= attribute as the actual content of the <textarea> element, can we instead somehow get it to run through the content escaper rather than the attribute escaper (which would then automatically include < in the things to be escaped)?

@baseballyama
Copy link
Member Author

Is this the right fix? Since we're serializing the value= attribute as the actual content of the <textarea> element, can we instead somehow get it to run through the content escaper rather than the attribute escaper (which would then automatically include < in the things to be escaped)?

OK. makes sense. I updated!

@Conduitry Conduitry changed the title fix: escape attribute properly fix: escape <textarea value={...}> attribute properly Mar 30, 2023
@Conduitry Conduitry merged commit 5a934e9 into sveltejs:master Mar 30, 2023
25 of 26 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

XSS vulnerability with textarea
3 participants