fix: dump encode data in comment

.changeset/shaggy-monkeys-fail.md

@@ -0,0 +1,5 @@
+---
+"@lynx-js/web-core-server": patch
+---
+
+fix: dump encode data in comment

packages/web-platform/web-core-server/src/createLynxView.ts

@@ -43,6 +43,7 @@ interface LynxViewConfig extends
   >;
   autoSize?: boolean;
   lynxViewStyle?: string;
+  threadStrategy?: 'all-on-ui';
 }
 
 const builtinElementTemplates = {
@@ -90,6 +91,7 @@ export async function createLynxView(
     autoSize,
     injectStyles,
     lynxViewStyle,
+    threadStrategy = 'all-on-ui',
   } = config;
   const template = await loadTemplate(rawTemplate, config.templateName);
   const { promise: firstPaintReadyPromise, resolve: firstPaintReady } = Promise
@@ -142,18 +144,17 @@ export async function createLynxView(
     buffer.push(
       '<lynx-view url="',
       hydrateUrl,
-      '" ssr',
+      '" ssr ',
+      'thread-strategy="',
+      threadStrategy,
+      '"',
     );
     if (autoSize) {
       buffer.push(' height="auto" width="auto"');
     }
     if (lynxViewStyle) {
       buffer.push(' style="', lynxViewStyle, '"');
     }
-    if (ssrEncodeData) {
-      const encodeDataEncoded = ssrEncodeData ? encodeURI(ssrEncodeData) : ''; // to avoid XSS
-      buffer.push(' ssr-encode-data="', encodeDataEncoded, '"');
-    }
     buffer.push(
       '><template shadowrootmode="open">',
       '<style>',
@@ -169,8 +170,13 @@ export async function createLynxView(
     );
     buffer.push(
       '</template>',
-      '</lynx-view>',
     );
+
+    if (ssrEncodeData) {
+      const encodeDataEncoded = ssrEncodeData ? encodeURI(ssrEncodeData) : ''; // to avoid XSS
+      buffer.push('<!--', encodeDataEncoded, '-->');
+    }
+    buffer.push('</lynx-view>');
     return buffer.join('');
   }
   return {

packages/web-platform/web-core-server/src/dumpHTMLString.ts

@@ -5,6 +5,7 @@ import {
   type OffscreenDocument,
   type OffscreenElement,
 } from '@lynx-js/offscreen-document/webworker';
+import { escapeHtml } from './utils/escapeHtml.js';
 
 type ShadowrootTemplates =
   | ((
@@ -24,7 +25,7 @@ function getInnerHTMLImpl(
     buffer.push(' ');
     buffer.push(key);
     buffer.push('="');
-    buffer.push(value);
+    buffer.push(escapeHtml(value));
     buffer.push('"');
   }
 

packages/web-platform/web-core-server/src/utils/escapeHtml.ts

@@ -0,0 +1,73 @@
+/**
+ *
+ * MIT License
+
+Copyright (c) Facebook, Inc. and its affiliates.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+ *
+ *
+ * forked from facebook/react
+ */
+const matchHtmlRegExp = /["'&<>]/;
+
+export function escapeHtml(string: string) {
+  const str = '' + string;
+  const match = matchHtmlRegExp.exec(str);
+
+  if (!match) {
+    return str;
+  }
+
+  let escape;
+  let html = '';
+  let index;
+  let lastIndex = 0;
+
+  for (index = match.index; index < str.length; index++) {
+    switch (str.charCodeAt(index)) {
+      case 34: // "
+        escape = '&quot;';
+        break;
+      case 38: // &
+        escape = '&amp;';
+        break;
+      case 39: // '
+        escape = '&#x27;'; // modified from escape-html; used to be '&#39'
+        break;
+      case 60: // <
+        escape = '&lt;';
+        break;
+      case 62: // >
+        escape = '&gt;';
+        break;
+      default:
+        continue;
+    }
+
+    if (lastIndex !== index) {
+      html += str.substring(lastIndex, index);
+    }
+
+    lastIndex = index + 1;
+    html += escape;
+  }
+
+  return lastIndex !== index ? html + str.substring(lastIndex, index) : html;
+}