Security audit finding, commit abf4e87.
File: src/core/render.ts:122-124 (streamSwap), src/core/render.ts:307-310 (metadataSwap)
Attack / Failure scenario
streamSwap embeds rendered page HTML inside <template>...</template> without transformation. If app-rendered raw HTML contains a literal </template>, it closes the wrapper early, and everything after it becomes sibling content outside the intended slot — breaking the streaming swap.
Properly escaped user data is unaffected; this only bites app code that emits a raw literal </template> in page output.
Suggested fix
Ensure the wrapped payload cannot contain a raw </template>:
- document the constraint for app authors, and/or
- escape/segment the payload or use a sentinel-delimited delivery so a literal
</template> in content cannot terminate the wrapper.
Security audit finding, commit
abf4e87.File:
src/core/render.ts:122-124(streamSwap),src/core/render.ts:307-310(metadataSwap)Attack / Failure scenario
streamSwapembeds rendered page HTML inside<template>...</template>without transformation. If app-rendered raw HTML contains a literal</template>, it closes the wrapper early, and everything after it becomes sibling content outside the intended slot — breaking the streaming swap.Properly escaped user data is unaffected; this only bites app code that emits a raw literal
</template>in page output.Suggested fix
Ensure the wrapped payload cannot contain a raw
</template>:</template>in content cannot terminate the wrapper.