From a2b40db9a83b36ed9da3a16403cf8f040262d73f Mon Sep 17 00:00:00 2001 From: edison Date: Tue, 11 Aug 2026 15:28:17 +0800 Subject: [PATCH] fix(server-renderer): reject CR in attribute names (#15266) --- .../server-renderer/__tests__/ssrRenderAttrs.spec.ts | 11 +++++++++++ packages/shared/src/domAttrConfig.ts | 2 +- 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/packages/server-renderer/__tests__/ssrRenderAttrs.spec.ts b/packages/server-renderer/__tests__/ssrRenderAttrs.spec.ts index 979e3a4b3..09bf42301 100644 --- a/packages/server-renderer/__tests__/ssrRenderAttrs.spec.ts +++ b/packages/server-renderer/__tests__/ssrRenderAttrs.spec.ts @@ -118,6 +118,17 @@ describe('ssr: renderAttrs', () => { ), ).toBe(` viewBox="foo"`) }) + + test('ignore attr names containing carriage returns', () => { + expect( + ssrRenderAttrs({ + id: 'safe', + ['x\rautofocus\ronfocus']: 'alert(1)', + }), + ).toBe(` id="safe"`) + expect(`unsafe attribute name`).toHaveBeenWarned() + expect(`Skipped rendering unsafe attribute name`).toHaveBeenWarned() + }) }) describe('ssr: renderAttr', () => { diff --git a/packages/shared/src/domAttrConfig.ts b/packages/shared/src/domAttrConfig.ts index 797cc1126..bac07abe5 100644 --- a/packages/shared/src/domAttrConfig.ts +++ b/packages/shared/src/domAttrConfig.ts @@ -33,7 +33,7 @@ export function includeBooleanAttr(value: unknown): boolean { return !!value || value === '' } -const unsafeAttrCharRE = /[>/="'\u0009\u000a\u000c\u0020]/ +const unsafeAttrCharRE = /[>/="'\u0009\u000a\u000c\u000d\u0020]/ const attrValidationCache: Record = {} export function isSSRSafeAttrName(name: string): boolean { -- 2.47.3