refactor: v2 release #6903
refactor: v2 release #6903
Conversation
🦋 Changeset detectedLatest commit: a6ea466 The changes in this PR will be included in the next version bump. This PR includes changesets to release 5 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
commit: |
built with Refined Cloudflare Pages Action⚡ Cloudflare Pages Deployment
|
| } | ||
| errorDiv.setAttribute('q:key', '_error_'); | ||
| const journal: VNodeJournal = []; | ||
| vnode_getDOMChildNodes(journal, vHost).forEach((child) => errorDiv.appendChild(child)); |
Check warning
Code scanning / CodeQL
DOM text reinterpreted as HTML Medium
| } else if (key === 'value' && key in element) { | ||
| (element as any).value = escapeHTML(String(value)); | ||
| } else if (key === dangerouslySetInnerHTML) { | ||
| (element as any).innerHTML = value!; |
Check warning
Code scanning / CodeQL
DOM text reinterpreted as HTML Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 4 days ago
To fix the problem, we need to ensure that any HTML content assigned to innerHTML is properly sanitized to prevent XSS attacks. This can be achieved by using a library like DOMPurify to sanitize the HTML content before assigning it to innerHTML.
- Import the
DOMPurifylibrary. - Use
DOMPurify.sanitizeto sanitize thevaluebefore assigning it toinnerHTML. - Ensure that the
DOMPurifylibrary is included in the project dependencies.
| @@ -1,4 +1,4 @@ | ||
| import DOMPurify from 'dompurify'; | ||
| /** | ||
| * @file | ||
| * | ||
| * VNode is a DOM like API for walking the DOM but it: | ||
| @@ -895,3 +895,3 @@ | ||
| } else if (key === dangerouslySetInnerHTML) { | ||
| (element as any).innerHTML = value!; | ||
| (element as any).innerHTML = DOMPurify.sanitize(value!); | ||
| } else { |
| @@ -10,3 +10,4 @@ | ||
| "dependencies": { | ||
| "csstype": "^3.1" | ||
| "csstype": "^3.1", | ||
| "dompurify": "^3.2.4" | ||
| }, |
| Package | Version | Security advisories |
| dompurify (npm) | 3.2.4 | None |
| const insertBefore = journal[idx++] as Element | Text | null; | ||
| let newChild: any; | ||
| while (idx < length && typeof (newChild = journal[idx]) !== 'number') { | ||
| insertParent.insertBefore(newChild, insertBefore); |
Check warning
Code scanning / CodeQL
DOM text reinterpreted as HTML Medium
`flags`, `varProps` and `constProps` This assures compatibility with v1 types
they are not necessary and they make the API harder to grasp
chore: make v2 types v1 compatible
fix: component as function call
fix(v2): fix component type
V2 Version Packages (alpha)
get it from a different qrl instead
also refactor
refactor(core): schedule QRLs instead of direct execution
Co-authored-by: wuls <[email protected]>
this provides a better hint it's done by Qwik ⚡
fix: build and codeql
fix(repl): properly resolve handlers.mjs
Co-authored-by: wuls <[email protected]>
Co-authored-by: Wout Mertens <[email protected]>
fix(perf): use sets instead of arrays for effects
This PR is for showing progress on v2, and having installable npm packages.
DO NOT MERGE
The changes are meant to be readable and maintainable, so if things are unclear please let us know.