Skip to content

Commit

Permalink
Ignore non-VNode objects during rendering
Browse files Browse the repository at this point in the history
This fixes #245.
  • Loading branch information
developit authored and marvinhagemeister committed Oct 4, 2022
1 parent 60075a5 commit 70e4c53
Show file tree
Hide file tree
Showing 5 changed files with 20 additions and 0 deletions.
3 changes: 3 additions & 0 deletions src/index.js
Original file line number Diff line number Diff line change
Expand Up @@ -210,6 +210,9 @@ function _renderToString(vnode, context, isSvgMode, selectValue, parent) {
return rendered;
}

// VNodes have {constructor:undefined} to prevent JSON injection:
if (vnode.constructor !== undefined) return '';

vnode[PARENT] = parent;
if (options[DIFF]) options[DIFF](vnode);

Expand Down
3 changes: 3 additions & 0 deletions src/pretty.js
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,9 @@ export function _renderToStringPretty(
return rendered;
}

// VNodes have {constructor:undefined} to prevent JSON injection:
if (vnode.constructor !== undefined) return '';

let nodeName = vnode.type,
props = vnode.props,
isComponent = false;
Expand Down
4 changes: 4 additions & 0 deletions test/jsx.test.js
Original file line number Diff line number Diff line change
Expand Up @@ -163,4 +163,8 @@ describe('jsx', () => {
<meta charset="utf-8" />
`);
});

it('should prevent JSON injection', () => {
expect(renderJsx(<div>{{ hello: 'world' }}</div>)).to.equal('<div></div>');
});
});
6 changes: 6 additions & 0 deletions test/pretty.test.js
Original file line number Diff line number Diff line change
Expand Up @@ -222,4 +222,10 @@ describe('pretty', () => {
</p>
`);
});

it('should prevent JSON injection', () => {
expect(prettyRender(<div>{{ hello: 'world' }}</div>)).to.equal(
'<div></div>'
);
});
});
4 changes: 4 additions & 0 deletions test/render.test.js
Original file line number Diff line number Diff line change
Expand Up @@ -1260,4 +1260,8 @@ describe('render', () => {
'<select><option selected value="2">2</option></select>'
);
});

it('should prevent JSON injection', () => {
expect(render(<div>{{ hello: 'world' }}</div>)).to.equal('<div></div>');
});
});

0 comments on commit 70e4c53

Please sign in to comment.