diff --git a/.changeset/curly-bananas-do.md b/.changeset/curly-bananas-do.md new file mode 100644 index 00000000..19a81f08 --- /dev/null +++ b/.changeset/curly-bananas-do.md @@ -0,0 +1,5 @@ +--- +'preact-render-to-string': patch +--- + +Fix object children being rendered as `undefined` diff --git a/src/index.js b/src/index.js index 9892d218..206a1d67 100644 --- a/src/index.js +++ b/src/index.js @@ -210,6 +210,9 @@ function _renderToString(vnode, context, isSvgMode, selectValue, parent) { return rendered; } + // VNodes have {constructor:undefined} to prevent JSON injection: + if (vnode.constructor !== undefined) return ''; + vnode[PARENT] = parent; if (options[DIFF]) options[DIFF](vnode); diff --git a/src/pretty.js b/src/pretty.js index 4d85cbc7..de7e66d3 100644 --- a/src/pretty.js +++ b/src/pretty.js @@ -53,6 +53,9 @@ export function _renderToStringPretty( return rendered; } + // VNodes have {constructor:undefined} to prevent JSON injection: + if (vnode.constructor !== undefined) return ''; + let nodeName = vnode.type, props = vnode.props, isComponent = false; diff --git a/test/jsx.test.js b/test/jsx.test.js index 733ebaf4..e2969835 100644 --- a/test/jsx.test.js +++ b/test/jsx.test.js @@ -163,4 +163,8 @@ describe('jsx', () => { `); }); + + it('should prevent JSON injection', () => { + expect(renderJsx(