Skip to content

Commit bbcf4d1

Browse files
committed
Use escapeTextForBrowser to encode dynamic strings
We can now use local dependencies
1 parent d8d48f7 commit bbcf4d1

File tree

1 file changed

+3
-4
lines changed

1 file changed

+3
-4
lines changed

packages/react-dom/src/server/ReactDOMServerFormatConfig.js

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ import {
1414
convertStringToBuffer,
1515
} from 'react-server/src/ReactServerStreamConfig';
1616

17+
import escapeTextForBrowser from './escapeTextForBrowser';
1718
import invariant from 'shared/invariant';
1819

1920
// Per response,
@@ -46,13 +47,11 @@ export function createSuspenseBoundaryID(
4647
}
4748

4849
function encodeHTMLIDAttribute(value: string): string {
49-
// TODO: This needs to be encoded for security purposes.
50-
return value;
50+
return escapeTextForBrowser(value);
5151
}
5252

5353
function encodeHTMLTextNode(text: string): string {
54-
// TOOD: This needs to be encoded for security purposes.
55-
return text;
54+
return escapeTextForBrowser(text);
5655
}
5756

5857
export function pushTextInstance(

0 commit comments

Comments
 (0)