Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

refactor: v2 release #6903

Open
wants to merge 732 commits into
base: main
Choose a base branch
from
Open

refactor: v2 release #6903

wants to merge 732 commits into from

Conversation

wmertens
Copy link
Member

@wmertens wmertens commented Sep 22, 2024

This PR is for showing progress on v2, and having installable npm packages.

DO NOT MERGE

The changes are meant to be readable and maintainable, so if things are unclear please let us know.

Copy link

changeset-bot bot commented Sep 22, 2024

🦋 Changeset detected

Latest commit: d848ba5

The changes in this PR will be included in the next version bump.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

Copy link

pkg-pr-new bot commented Sep 23, 2024

Open in Stackblitz

npm i https://pkg.pr.new/QwikDev/qwik/@qwik.dev/core@6903
npm i https://pkg.pr.new/QwikDev/qwik/@qwik.dev/router@6903
npm i https://pkg.pr.new/QwikDev/qwik/eslint-plugin-qwik@6903
npm i https://pkg.pr.new/QwikDev/qwik/create-qwik@6903

commit: d848ba5

Copy link
Contributor

github-actions bot commented Sep 23, 2024

built with Refined Cloudflare Pages Action

⚡ Cloudflare Pages Deployment

Name Status Preview Last Commit
qwik-docs ✅ Ready (View Log) Visit Preview d848ba5

}
errorDiv.setAttribute('q:key', '_error_');
const journal: VNodeJournal = [];
vnode_getDOMChildNodes(journal, vHost).forEach((child) => errorDiv.appendChild(child));

Check warning

Code scanning / CodeQL

DOM text reinterpreted as HTML Medium

DOM text
is reinterpreted as HTML without escaping meta-characters.
DOM text
is reinterpreted as HTML without escaping meta-characters.
} else if (key === 'value' && key in element) {
(element as any).value = escapeHTML(String(value));
} else if (key === dangerouslySetInnerHTML) {
(element as any).innerHTML = value!;

Check warning

Code scanning / CodeQL

DOM text reinterpreted as HTML Medium

DOM text
is reinterpreted as HTML without escaping meta-characters.
DOM text
is reinterpreted as HTML without escaping meta-characters.

Copilot Autofix AI 3 days ago

To fix the problem, we need to ensure that any data assigned to innerHTML is properly sanitized to prevent XSS attacks. The best way to fix this without changing existing functionality is to use a function that escapes HTML special characters before assigning the value to innerHTML.

  1. Import or define a function to escape HTML special characters.
  2. Use this function to sanitize the value before assigning it to innerHTML.
Suggested changeset 1
packages/qwik/src/core/client/vnode.ts

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/packages/qwik/src/core/client/vnode.ts b/packages/qwik/src/core/client/vnode.ts
--- a/packages/qwik/src/core/client/vnode.ts
+++ b/packages/qwik/src/core/client/vnode.ts
@@ -895,3 +895,3 @@
         } else if (key === dangerouslySetInnerHTML) {
-          (element as any).innerHTML = value!;
+          (element as any).innerHTML = escapeHTML(String(value));
         } else {
EOF
@@ -895,3 +895,3 @@
} else if (key === dangerouslySetInnerHTML) {
(element as any).innerHTML = value!;
(element as any).innerHTML = escapeHTML(String(value));
} else {
Copilot is powered by AI and may make mistakes. Always verify output.
Positive Feedback
Negative Feedback

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

Please select one or more of the options
const insertBefore = journal[idx++] as Element | Text | null;
let newChild: any;
while (idx < length && typeof (newChild = journal[idx]) !== 'number') {
insertParent.insertBefore(newChild, insertBefore);

Check warning

Code scanning / CodeQL

DOM text reinterpreted as HTML Medium

DOM text
is reinterpreted as HTML without escaping meta-characters.
DOM text
is reinterpreted as HTML without escaping meta-characters.
@wmertens wmertens changed the title refactor: v2 framework rewrite refactor: v2 release Oct 8, 2024
@wmertens wmertens marked this pull request as ready for review October 17, 2024 21:25
@wmertens wmertens requested review from a team as code owners October 17, 2024 21:25
github-actions bot and others added 30 commits January 10, 2025 19:00
fix: wait for QRL to resolve for signal attribute
Revert "fix: wait for QRL to resolve for signal attribute"
fix: input's value is string when passing number
fix: convert destructured array's props to signal
fix(repl): resolve core/internal
…throw

fix: retry vnode diffing on promise throw
feat: log a warning instead of throwing an error for server host mismatch error
Version Packages (alpha)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants