solidjs / solid / 35741238914

74%

main: 89%

push

github

fix(compiler): escape static text on SSR spread elements (#3557) (#3559)

* fix(compiler): escape static text on SSR spread elements (#3557)

Static JSX text children of a spread element were pushed to `ssrElement`
as decoded strings, and `ssrElement` joins string children verbatim, so
`<div {...p}>a &lt;b&gt;</div>` rendered a real `<b>`. Both compilers now
escape the text unless the element is `script` or `style`.

The textarea `value` fold wrote the decoded value into the template, so
`<textarea value="a &lt;b&gt;" />` rendered `a <b>`; the fold now escapes
the text in both compilers.

The Babel plugin folded a textarea `value` into children on spread
elements too, which the native compiler never did. The fold ran before
the sources were assembled, so any source's `value` overwrote the static
regardless of order. The fold is now skipped when the element carries a
spread and the value stays a prop of the running source object, where
the runtime applies source precedence and escapes it. Static string props
of Babel spread elements are rebuilt from their decoded value, since the
generator prints a JSX attribute literal from its raw entity text.

* fix: address review findings

A static string expression child of a spread `script` or `style` element
(`<script {...props}>{"a < b"}</script>`) is no longer HTML-escaped by the
Babel SSR transform: `createElement` now forwards `doNotEscape` to
`transformNode`, as the template path already did, matching the native
compiler and the non-spread output.

The `decodedAttrValue` helper in `universal/element.ts` is exported and
replaces the identical inline idiom in the SSR, DOM and component spread
paths; the output is unchanged.

* chore: rebase #3559 over hoistProps; changeset summary

Co-authored-by: Claude via Cursor <noreply@cursor.com>

* test(web): silence TS2783 on the intentional duplicate value in the spread specs

Co-authored-by: Claude via Cursor <noreply@cursor.com>

---------

Co-authored-by: Ryan Ca... (continued)

550 of 818 branches covered (67.24%)

Branch coverage included in aggregate %.

824 of 1070 relevant lines covered (77.01%)

17.4 hits per line