Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Move validation of <style> contents to compilation #3454

Closed
Tracked by #2964
nolanlawson opened this issue Apr 10, 2023 · 1 comment · Fixed by #4201
Closed
Tracked by #2964

Move validation of <style> contents to compilation #3454

nolanlawson opened this issue Apr 10, 2023 · 1 comment · Fixed by #4201

Comments

@nolanlawson
Copy link
Contributor

As of #3442, we check for CSS that cannot be inlined into <style> tags (e.g. because it contains the string </style>, which could could cause an XSS vulnerability).

Right now we pay this cost during SSR, but ideally this validation should be done once during compilation, not multiple times during SSR. However, this would be a breaking change, since it could impact existing LEX components (which currently don't need to support SSR).

Another solution would be to find some other solution entirely that doesn't involve validating the <style> contents. (E.g. figuring out a clever way to escape a CSS selector like [attr="</style>"], assuming that this pattern even exists in the wild.)

Copy link

git2gus bot commented Apr 26, 2024

This issue has been linked to a new work item: W-15618965

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
1 participant