Escape HTML by default

.changeset/sour-socks-enjoy.md

@@ -0,0 +1,5 @@
+---
+'astro': minor
+---
+
+Escape HTML inside of expressions by default. Please see [our migration guide](https://docs.astro.build/en/migrate/#deprecated-unescaped-html) for more details.

packages/astro/package.json

@@ -58,7 +58,7 @@
     "test:match": "mocha --timeout 20000 -g"
   },
   "dependencies": {
-    "@astrojs/compiler": "^0.12.0-next.8",
+    "@astrojs/compiler": "^0.12.0-next.9",
     "@astrojs/language-server": "^0.8.6",
     "@astrojs/markdown-remark": "^0.6.4",
     "@astrojs/prism": "0.4.0",
@@ -95,10 +95,10 @@
     "resolve": "^1.20.0",
     "rollup": "^2.64.0",
     "semver": "^7.3.5",
-    "sirv": "^2.0.2",
     "serialize-javascript": "^6.0.0",
     "shiki": "^0.10.0",
     "shorthash": "^0.0.2",
+    "sirv": "^2.0.2",
     "slash": "^4.0.0",
     "sourcemap-codec": "^1.4.8",
     "srcset-parse": "^1.1.0",

packages/astro/src/runtime/server/escape.ts

@@ -1,23 +1,6 @@
 const entities = { '"': 'quot', '&': 'amp', "'": 'apos', '<': 'lt', '>': 'gt' } as const;
 
-const warned = new Set<string>();
-export const escapeHTML = (string: any, { deprecated = false }: { deprecated?: boolean } = {}) => {
-	const escaped = string.replace(/["'&<>]/g, (char: keyof typeof entities) => '&' + entities[char] + ';');
-	if (!deprecated) return escaped;
-	if (warned.has(string) || !string.match(/[&<>]/g)) return string;
-	// eslint-disable-next-line no-console
-	console.warn(`Unescaped HTML content found inside expression!
-
-The next minor version of Astro will automatically escape all
-expression content. Please use the \`set:html\` directive.
-
-Expression content:
-${string}`);
-	warned.add(string);
-
-	// Return unescaped content for now. To be removed.
-	return string;
-};
+export const escapeHTML = (string: any) => string.replace(/["'&<>]/g, (char: keyof typeof entities) => '&' + entities[char] + ';');
 
 /**
  * RawString is a "blessed" version of String

packages/astro/src/runtime/server/index.ts

@@ -8,7 +8,7 @@ import { escapeHTML, UnescapedString, unescapeHTML } from './escape.js';
 
 export type { Metadata } from './metadata';
 export { createMetadata } from './metadata.js';
-export { escapeHTML, unescapeHTML } from './escape.js';
+export { unescapeHTML } from './escape.js';
 
 const voidElementNames = /^(area|base|br|col|command|embed|hr|img|input|keygen|link|meta|param|source|track|wbr)$/i;
 const htmlBooleanAttributes =
@@ -36,7 +36,7 @@ async function _render(child: any): Promise<any> {
 		// of wrapping it in a function and calling it.
 		return _render(child());
 	} else if (typeof child === 'string') {
-		return escapeHTML(child, { deprecated: true });
+		return escapeHTML(child);
 	} else if (!child && child !== 0) {
 		// do nothing, safe to ignore falsey values.
 	}