solidjs / solid / 37651357889

77%

main: 89%

push

github

fix(web): SSR validates dynamic attribute and tag names (#3871)

A spread's keys and a `<Dynamic>` tag are runtime strings, and the server
wrote them into markup with text-mode escaping only, so a name containing
whitespace, a quote, `=`, `>` or `/` was read by the HTML parser as more
than one name. The client never produces such an element: `setAttribute`
and `createElement` refuse those names.

- Attribute names (`ssrElement`'s spread walk, the binding-slot spread
  paths) are checked against what ends or breaks a name in the tokenizer:
  ASCII whitespace, `"`, `'`, `<`, `>`, `/`, `=`, NUL and other control
  characters, or an empty name. A failing name is dropped. A passing name
  is written as is: `&` is no longer escaped to `&amp;`, which the parser
  keeps literally in a name.
- Tag names must also start with an ASCII letter; a failing tag throws,
  as the client's `createElement` does, into the nearest error boundary.
- Both checks run on a cache miss only (`safeAttrNames`, `tagInfos`), and
  only passing names are cached; `escape` is unchanged.

Co-authored-by: Claude via Cursor <noreply@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

654 of 932 branches covered (70.17%)

Branch coverage included in aggregate %.

964 of 1199 relevant lines covered (80.4%)

28.16 hits per line