Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Sanitize dynamic tags #5615

Merged
merged 3 commits into from
Dec 16, 2022
Merged

Sanitize dynamic tags #5615

merged 3 commits into from
Dec 16, 2022

Conversation

natemoo-re
Copy link
Member

Changes

  • Updates renderComponent to sanitize dynamic tags before printing
  • This was an unintentional way to inject attributes, not a feature. This PR will close off that security hole.

Testing

Added a unit test

Docs

N/A, just a security patch

@changeset-bot
Copy link

changeset-bot bot commented Dec 16, 2022

🦋 Changeset detected

Latest commit: 5af6bca

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@github-actions github-actions bot added the pkg: astro Related to the core `astro` package (scope) label Dec 16, 2022
@matthewp
Copy link
Contributor

!bench

@github-actions
Copy link
Contributor

Node: 14
PR: 25k requests in 30.06s, 1.69 GB read
MAIN: 24k requests in 30.09s, 1.66 GB read


Node: 16
PR: 20k requests in 30.1s, 1.34 GB read
MAIN: 20k requests in 30.07s, 1.37 GB read

@natemoo-re
Copy link
Member Author

!bench

@github-actions
Copy link
Contributor

Node: 14
PR: 16k requests in 30.08s, 1.08 GB read
MAIN: 16k requests in 30.11s, 1.09 GB read


Node: 16
PR: 21k requests in 30.06s, 1.46 GB read
MAIN: 21k requests in 30.07s, 1.45 GB read

@natemoo-re natemoo-re merged commit d85ec74 into main Dec 16, 2022
@natemoo-re natemoo-re deleted the fix/sanitize-dynamic-tags branch December 16, 2022 19:14
@astrobot-houston astrobot-houston mentioned this pull request Dec 16, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
pkg: astro Related to the core `astro` package (scope)
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants