Skip to content
This repository has been archived by the owner on Oct 1, 2024. It is now read-only.

Revert jsesc #2574

Merged
merged 2 commits into from
Feb 22, 2023
Merged

Revert jsesc #2574

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7ac06da
Revert "Merge pull request #2570 from Shopify/atesgoral/use-jsesc"
atesgoral Feb 22, 2023
0385b8f
Add changeset
atesgoral Feb 22, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions .changeset/cuddly-squids-look.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
---
'@shopify/react-html': patch
'@shopify/react-server': patch
---

Revert replacement of serialize-javascript with jsesc due to performance regression
4 changes: 2 additions & 2 deletions packages/react-html/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,8 +33,8 @@
"@shopify/react-effect": "^5.0.2",
"@shopify/react-hydrate": "^3.0.6",
"@types/multistream": "^2.1.1",
"jsesc": "^3.0.2",
"multistream": "^2.1.1"
"multistream": "^2.1.1",
"serialize-javascript": "^3.0.0"
},
"peerDependencies": {
"react": ">=16.8.0 <19.0.0",
Expand Down
9 changes: 2 additions & 7 deletions packages/react-html/src/server/components/Serialize.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
import React from 'react';
import jsesc from 'jsesc';
import serialize from 'serialize-javascript';

import {SERIALIZE_ATTRIBUTE} from '../../utilities';

Expand All @@ -9,15 +9,10 @@ interface Props {
}

export default function Serialize({id, data}: Props) {
const serialized = jsesc(data, {
isScriptContext: true,
json: true,
});

return (
<script
type="text/json"
dangerouslySetInnerHTML={{__html: serialized}}
dangerouslySetInnerHTML={{__html: serialize(data, {isJSON: true})}}
{...{[SERIALIZE_ATTRIBUTE]: id}}
/>
);
Expand Down
11 changes: 3 additions & 8 deletions packages/react-html/src/server/components/tests/Serialize.test.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
import React from 'react';
import serializeJavaScript from 'serialize-javascript';
import {mount} from '@shopify/react-testing';

import Serialize from '../Serialize';
Expand All @@ -22,20 +23,14 @@ describe('<Serialize />', () => {
describe('data', () => {
it('serializes the content as the child contents of the script tag', () => {
const data = {
foo: {
bar: {
baz: 'window.location = "http://example.com"',
},
},
xss: '</script><script>alert("hax")</script>',
foo: {bar: {baz: 'window.location = "http://dangerous.com"'}},
};

const serialize = mount(<Serialize id={id} data={data} />);

expect(serialize).toContainReactComponent('script', {
dangerouslySetInnerHTML: {
__html:
'{"foo":{"bar":{"baz":"window.location = \\"http://example.com\\""}},"xss":"<\\/script><script>alert(\\"hax\\")<\\/script>"}',
__html: serializeJavaScript(data, {isJSON: true}),
},
});
});
Expand Down
2 changes: 1 addition & 1 deletion packages/react-server/src/server/tests/server.test.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,7 +61,7 @@ describe('createServer()', () => {
const response = await wrapper.fetch('/');

expect(await response.clone().text()).toContain(
`<!DOCTYPE html><html lang="en"><head><meta charSet="utf-8"/><meta http-equiv="X-UA-Compatible" content="IE=edge"/><meta name="referrer" content="never"/></head><body><div id="app"><div>markup</div></div><script type="text/json" data-serialized-id="quilt-data">null</script></body></html>`,
`<!DOCTYPE html><html lang="en"><head><meta charSet="utf-8"/><meta http-equiv="X-UA-Compatible" content="IE=edge"/><meta name="referrer" content="never"/></head><body><div id="app"><div>markup</div></div><script type="text/json" data-serialized-id="quilt-data">undefined</script></body></html>`,
);
});

Expand Down
12 changes: 7 additions & 5 deletions yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9813,11 +9813,6 @@ jsesc@^2.5.1:
resolved "https://registry.yarnpkg.com/jsesc/-/jsesc-2.5.2.tgz#80564d2e483dacf6e8ef209650a67df3f0c283a4"
integrity sha512-OYu7XEzjkCQ3C5Ps3QIZsQfNpqoJyZZA99wd9aWd05NCtC5pWOkShK2mkL6HXQR6/Cy2lbNdPlZBpuQHXE63gA==

jsesc@^3.0.2:
version "3.0.2"
resolved "https://registry.yarnpkg.com/jsesc/-/jsesc-3.0.2.tgz#bb8b09a6597ba426425f2e4a07245c3d00b9343e"
integrity sha512-xKqzzWXDttJuOcawBt4KnKHHIf5oQ/Cxax+0PWFG+DFDgHNAdi+TXECADI+RYiFUMmx8792xsMbbgXj4CwnP4g==

jsesc@~0.5.0:
version "0.5.0"
resolved "https://registry.yarnpkg.com/jsesc/-/jsesc-0.5.0.tgz#e7dee66e35d6fc16f710fe91d5cf69f70f08911d"
Expand Down Expand Up @@ -12943,6 +12938,13 @@ sentence-case@^3.0.4:
tslib "^2.0.3"
upper-case-first "^2.0.2"

serialize-javascript@^3.0.0:
version "3.1.0"
resolved "https://registry.yarnpkg.com/serialize-javascript/-/serialize-javascript-3.1.0.tgz#8bf3a9170712664ef2561b44b691eafe399214ea"
integrity sha512-JIJT1DGiWmIKhzRsG91aS6Ze4sFUrYbltlkg2onR5OrnNM02Kl/hnY/T4FN2omvyeBbQmMJv+K4cPOpGzOTFBg==
dependencies:
randombytes "^2.1.0"

serialize-javascript@^4.0.0:
version "4.0.0"
resolved "https://registry.yarnpkg.com/serialize-javascript/-/serialize-javascript-4.0.0.tgz#b525e1238489a5ecfc42afacc3fe99e666f4b1aa"
Expand Down