fix: dump encode data in comment by PupilTong · Pull Request #989 · lynx-family/lynx-stack

PupilTong · 2025-06-04T08:59:09Z

No description provided.

changeset-bot · 2025-06-04T08:59:14Z

🦋 Changeset detected

Latest commit: e9cab21

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 6 packages

Name	Type
@lynx-js/web-core-server	Patch
@lynx-js/web-core	Patch
@lynx-js/web-constants	Patch
@lynx-js/web-mainthread-apis	Patch
@lynx-js/web-worker-rpc	Patch
@lynx-js/web-worker-runtime	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

Copilot

Pull Request Overview

This PR fixes the dumping of encode data by moving it from an attribute to an HTML comment, reducing potential XSS risks and ensuring that snapshot outputs align with the updated rendering logic.

Updates snapshot files to remove the ssr-encode-data attribute and add the thread-strategy attribute.
Introduces a new escapeHtml utility function and applies it when rendering attribute values.
Modifies dumpHTMLString.ts and createLynxView.ts to output encode data as an HTML comment.

Reviewed Changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
packages/web-platform/web-tests/tests/snapshots/server.vitest.spec.ts.snap	Updated snapshots to reflect the removal of the ssr-encode-data attribute and introduction of thread-strategy.
packages/web-platform/web-core-server/src/utils/escapeHtml.ts	Added a new utility for escaping HTML special characters.
packages/web-platform/web-core-server/src/dumpHTMLString.ts	Changed the dumping of ssrEncodeData from an element attribute to an HTML comment, with proper escaping.
packages/web-platform/web-core-server/src/createLynxView.ts	Added support for a threadStrategy attribute and moved the encode data dump into an HTML comment.
.changeset/shaggy-monkeys-fail.md	Updated changeset for the patch release.

Comments suppressed due to low confidence (2)

packages/web-platform/web-core-server/src/createLynxView.ts:148

Ensure that the 'thread-strategy' attribute value is consistently handled by all consumers and that its allowed values are validated to avoid unexpected behavior.

'thread-strategy="', threadStrategy, '"'

packages/web-platform/web-core-server/src/dumpHTMLString.ts:175

Verify that dumping ssrEncodeData within an HTML comment does not affect downstream HTML parsing and that the change is consistently reflected in snapshot comparisons.

if (ssrEncodeData) {

codecov · 2025-06-04T09:05:20Z

Codecov Report

All modified and coverable lines are covered by tests ✅

📢 Thoughts on this report? Let us know!

codspeed-hq · 2025-06-04T09:09:38Z

CodSpeed Performance Report

Merging #989 will not alter performance

_{Comparing PupilTong:p/hw/ssr-escape-html (e9cab21) with main (4bad030)}

Summary

✅ 9 untouched benchmarks

relativeci · 2025-06-04T09:18:48Z

React Example

#1172 Bundle Size — 231.7KiB (0%).

e9cab21(current) vs 4bad030 main#1165(baseline)

Bundle metrics no changes

	Current #1172	Baseline #1165
Initial JS	`0B`	`0B`
Initial CSS	`0B`	`0B`
Cache Invalidation	`0%`	`0%`
Chunks	`0`	`0`
Assets	`4`	`4`
Modules	`141`	`141`
Duplicate Modules	`56`	`56`
Duplicate Code	`46.17%`	`46.17%`
Packages	`2`	`2`
Duplicate Packages	`0`	`0`

Bundle size by type no changes

	Current #1172	Baseline #1165
IMG	`145.76KiB`	`145.76KiB`
Other	`85.94KiB`	`85.94KiB`

Bundle analysis report Branch PupilTong:p/hw/ssr-escape-html Project dashboard

^{Generated by RelativeCI Documentation Report issue}

relativeci · 2025-06-04T09:18:54Z

Web Explorer

#1160 Bundle Size — 254.96KiB (0%).

e9cab21(current) vs 4bad030 main#1153(baseline)

Bundle metrics

1 change

	Current #1160	Baseline #1153
Initial JS	`136.84KiB`	`136.84KiB`
Initial CSS	`31.79KiB`	`31.79KiB`
Cache Invalidation	`0%`	`0%`
Chunks	`4`	`4`
Assets	`4`	`4`
Modules	`202`(`-0.49%`)	`203`
Duplicate Modules	`14`	`14`
Duplicate Code	`2.86%`	`2.86%`
Packages	`4`	`4`
Duplicate Packages	`0`	`0`

Bundle size by type no changes

	Current #1160	Baseline #1153
JS	`223.17KiB`	`223.17KiB`
CSS	`31.79KiB`	`31.79KiB`

Bundle analysis report Branch PupilTong:p/hw/ssr-escape-html Project dashboard

^{Generated by RelativeCI Documentation Report issue}

@deprecated

This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## @lynx-js/react@0.109.2 ### Patch Changes - Support for locating errors in the source code directly on the device when exceptions occur when using MTS. ([#1019](#1019)) This requires Lynx engine v3.4 or later. - Fix the "main-thread.js exception: ReferenceError: `__webpack_require__` is not defined" error in HMR. ([#985](#985)) This error occurred when setting `output.iife: true`, which is the default value in `@lynx-js/rspeedy` v0.9.8. ## @lynx-js/rspeedy@0.9.9 ### Patch Changes - Set `optimization.emitOnErrors` when `DEBUG` is enabled. ([#1000](#1000)) This is useful for debugging PrimJS Syntax error. ## @lynx-js/react-rsbuild-plugin@0.10.3 ### Patch Changes - Better [zustand](https://github.com/pmndrs/zustand) support by creating an alias for `use-sync-external-store`. ([#980](#980)) See [#893](#893) for more details. - Updated dependencies \[[`acc0d80`](acc0d80)]: - @lynx-js/runtime-wrapper-webpack-plugin@0.1.1 - @lynx-js/react-alias-rsbuild-plugin@0.10.3 - @lynx-js/use-sync-external-store@1.5.0 - @lynx-js/react-refresh-webpack-plugin@0.3.3 - @lynx-js/react-webpack-plugin@0.6.15 - @lynx-js/css-extract-webpack-plugin@0.5.4 - @lynx-js/template-webpack-plugin@0.7.2 ## @lynx-js/css-serializer@0.1.3 ### Patch Changes - Support Windows. ([#1007](#1007)) ## @lynx-js/offscreen-document@0.1.1 ### Patch Changes - feat: add sheet.insertRule support ([#1026](#1026)) - refactor: implement mts apis in closure pattern ([#1004](#1004)) ## @lynx-js/web-constants@0.13.5 ### Patch Changes - refactor: move some internal status to dom's attribute ([#945](#945)) It's essential for SSR - fix: target.id is undefined ([#1016](#1016)) - feat: add new pageConfig configuration: enableJSDataProcessor ([#886](#886)) - refactor: move component config info to attribute ([#984](#984)) - refactor: save dataset on an attribute ([#981](#981)) On lynx, the `data-*` attributes have different behaviors than the HTMLElement has. The dataset will be treated as properties, the key will not be applied the camel-case <-> hyphenate name transformation. Before this commit we use it as a runtime data, but after this commit we will use encodeURI(JSON.stringify(dataset)) to encode it as a string. - refactor: create elements of `elementToRuntimeInfoMap` on demand ([#986](#986)) - refactor: implement mts apis in closure pattern ([#1004](#1004)) - Updated dependencies \[]: - @lynx-js/web-worker-rpc@0.13.5 ## @lynx-js/web-core@0.13.5 ### Patch Changes - refactor: move some internal status to dom's attribute ([#945](#945)) It's essential for SSR - refactor: avoid to create many style element for cssog ([#1026](#1026)) - refactor: move component config info to attribute ([#984](#984)) - fix: ensure render starts after dom connected ([#1020](#1020)) - refactor: save dataset on an attribute ([#981](#981)) On lynx, the `data-*` attributes have different behaviors than the HTMLElement has. The dataset will be treated as properties, the key will not be applied the camel-case <-> hyphenate name transformation. Before this commit we use it as a runtime data, but after this commit we will use encodeURI(JSON.stringify(dataset)) to encode it as a string. - refactor: implement mts apis in closure pattern ([#1004](#1004)) - Updated dependencies \[[`70b82d2`](70b82d2), [`5651e24`](5651e24), [`9499ea9`](9499ea9), [`50f0193`](50f0193), [`57bf0ef`](57bf0ef), [`5651e24`](5651e24), [`0525fbf`](0525fbf), [`b6b87fd`](b6b87fd), [`c014327`](c014327)]: - @lynx-js/web-mainthread-apis@0.13.5 - @lynx-js/web-constants@0.13.5 - @lynx-js/offscreen-document@0.1.1 - @lynx-js/web-worker-runtime@0.13.5 - @lynx-js/web-worker-rpc@0.13.5 ## @lynx-js/web-core-server@0.13.5 ### Patch Changes - refactor: move some internal status to dom's attribute ([#945](#945)) It's essential for SSR - refactor: move component config info to attribute ([#984](#984)) - refactor: save dataset on an attribute ([#981](#981)) On lynx, the `data-*` attributes have different behaviors than the HTMLElement has. The dataset will be treated as properties, the key will not be applied the camel-case <-> hyphenate name transformation. Before this commit we use it as a runtime data, but after this commit we will use encodeURI(JSON.stringify(dataset)) to encode it as a string. - fix: dump encode data in comment ([#989](#989)) ## @lynx-js/web-elements@0.7.5 ### Patch Changes - feat: x-input && x-textarea add new method: `getValue`, which returns the value of the input element, selectionStart and selectEnd when success. ([#982](#982)) - feat: x-input and x-textarea bindinput event return structures add `selectionStart`, `selectionEnd`, and `textLength`, `textLength` are marked as @deprecated ([#996](#996)) - feat: x-input and x-textarea support bindselection event, the returned type structure is `{ selectionStart: number; selectionEnd: number }`. ([#990](#990)) - Updated dependencies \[]: - @lynx-js/web-elements-template@0.7.5 ## @lynx-js/web-mainthread-apis@0.13.5 ### Patch Changes - refactor: move some internal status to dom's attribute ([#945](#945)) It's essential for SSR - refactor: avoid to create many style element for cssog ([#1026](#1026)) - fix: target.id is undefined ([#1016](#1016)) - feat: add new pageConfig configuration: enableJSDataProcessor ([#886](#886)) - refactor: move component config info to attribute ([#984](#984)) - refactor: save dataset on an attribute ([#981](#981)) On lynx, the `data-*` attributes have different behaviors than the HTMLElement has. The dataset will be treated as properties, the key will not be applied the camel-case <-> hyphenate name transformation. Before this commit we use it as a runtime data, but after this commit we will use encodeURI(JSON.stringify(dataset)) to encode it as a string. - refactor: create elements of `elementToRuntimeInfoMap` on demand ([#986](#986)) - refactor: implement mts apis in closure pattern ([#1004](#1004)) - Updated dependencies \[[`70b82d2`](70b82d2), [`9499ea9`](9499ea9), [`50f0193`](50f0193), [`57bf0ef`](57bf0ef), [`0525fbf`](0525fbf), [`b6b87fd`](b6b87fd), [`c014327`](c014327)]: - @lynx-js/web-constants@0.13.5 ## @lynx-js/web-worker-runtime@0.13.5 ### Patch Changes - refactor: implement mts apis in closure pattern ([#1004](#1004)) - Updated dependencies \[[`70b82d2`](70b82d2), [`5651e24`](5651e24), [`9499ea9`](9499ea9), [`50f0193`](50f0193), [`57bf0ef`](57bf0ef), [`5651e24`](5651e24), [`0525fbf`](0525fbf), [`b6b87fd`](b6b87fd), [`c014327`](c014327)]: - @lynx-js/web-mainthread-apis@0.13.5 - @lynx-js/web-constants@0.13.5 - @lynx-js/offscreen-document@0.1.1 - @lynx-js/web-worker-rpc@0.13.5 ## @lynx-js/runtime-wrapper-webpack-plugin@0.1.1 ### Patch Changes - Fix `requestAnimationFrame` is not working. ([#1021](#1021)) ## @lynx-js/template-webpack-plugin@0.7.2 ### Patch Changes - Updated dependencies \[[`ccb4254`](ccb4254)]: - @lynx-js/css-serializer@0.1.3 ## create-rspeedy@0.9.9 ## @lynx-js/react-alias-rsbuild-plugin@0.10.3 ## upgrade-rspeedy@0.9.9 ## @lynx-js/web-elements-template@0.7.5 ## @lynx-js/web-worker-rpc@0.13.5 Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

fix: dump encode data in comment

e9cab21

PupilTong requested review from Sherry-hue and Copilot June 4, 2025 08:59

PupilTong self-assigned this Jun 4, 2025

PupilTong added this to Lynx for Web Jun 4, 2025

PupilTong added the platform:Web label Jun 4, 2025

Copilot AI reviewed Jun 4, 2025

View reviewed changes

Sherry-hue approved these changes Jun 4, 2025

View reviewed changes

PupilTong added this pull request to the merge queue Jun 4, 2025

Merged via the queue into lynx-family:main with commit 960dd1e Jun 4, 2025
40 checks passed

PupilTong deleted the p/hw/ssr-escape-html branch June 4, 2025 15:18

github-project-automation bot moved this to Done in Lynx for Web Jun 4, 2025

github-actions bot mentioned this pull request Jun 4, 2025

chore: Release 2025-06-06 12:15:14 #979

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: dump encode data in comment#989

fix: dump encode data in comment#989
PupilTong merged 1 commit intolynx-family:mainfrom
PupilTong:p/hw/ssr-escape-html

PupilTong commented Jun 4, 2025

Uh oh!

changeset-bot bot commented Jun 4, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

codecov bot commented Jun 4, 2025

Uh oh!

codspeed-hq bot commented Jun 4, 2025

Uh oh!

relativeci bot commented Jun 4, 2025

Uh oh!

relativeci bot commented Jun 4, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

PupilTong commented Jun 4, 2025

Uh oh!

changeset-bot bot commented Jun 4, 2025

🦋 Changeset detected

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

codecov bot commented Jun 4, 2025

Codecov Report

Uh oh!

codspeed-hq bot commented Jun 4, 2025

CodSpeed Performance Report

Merging #989 will not alter performance

Summary

Uh oh!

relativeci bot commented Jun 4, 2025

React Example

#1172 Bundle Size — 231.7KiB (0%).

Uh oh!

relativeci bot commented Jun 4, 2025

Web Explorer

#1160 Bundle Size — 254.96KiB (0%).

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants