solidjs / solid / 38358249702

78%

main: 89%

push

github

fix(web): escape < in useHead JSON script bodies (#4012)

useHead only rewrote `</script` in inline script bodies on the server. In
a JSON-LD script, a value such as `<!--<script>` moves the HTML tokenizer
into the double-escaped state, so the closing `</script>` no longer ends
the element and the markup after it becomes script text, up to a later
`</script>` or the end of the document.

Scripts whose body is JSON (importmap, speculationrules, and the JSON MIME
types: application/json, text/json, any +json subtype) now get every `<`
written as `\u003C`, which parses back to the same value. The shell
markup, the streamed head ops and the client registry share the helper,
so the client writes and compares the same text and hydration adopts the
server element instead of replacing it. Other scripts and data blocks keep
their current body.

On the server the escape is installed by useHead, the only way tags reach
the head registry, so a render without useHead (the server-render size
floor) does not carry it.

746 of 1036 branches covered (72.01%)

Branch coverage included in aggregate %.

1079 of 1321 relevant lines covered (81.68%)

27.15 hits per line