Skip to content
This repository has been archived by the owner on May 17, 2019. It is now read-only.

No html escape for developer error #654

Open
slonoed opened this issue Dec 21, 2018 · 0 comments
Open

No html escape for developer error #654

slonoed opened this issue Dec 21, 2018 · 0 comments

Comments

@slonoed
Copy link

slonoed commented Dec 21, 2018

Error message and stack are inserted into a page when server-side rendering error occurs in dev mode.

Type of issue

Bug (maybe minor)

Current behavior

Add throw new Error('<script>alert(1)<script>') into Root compoentnt. Reload page: browser shows red page with error. Script tag inserted as is. By default CSP doesn't allow scripts, so it is not executed.

Fusion code

Expected behavior

HTML tags are escaped.

Your environment

  • fusion-cli version:
    1.13.1
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant