diff --git a/.changeset/quiet-dragons-lay.md b/.changeset/quiet-dragons-lay.md new file mode 100644 index 00000000..33aa11c2 --- /dev/null +++ b/.changeset/quiet-dragons-lay.md @@ -0,0 +1,5 @@ +--- +"preact-render-to-string": major +--- + +fix: escape a single quote diff --git a/src/util.js b/src/util.js index bc80ea48..42ddff0a 100644 --- a/src/util.js +++ b/src/util.js @@ -5,7 +5,7 @@ export const HTML_LOWER_CASE = /^accessK|^auto[A-Z]|^ch|^col|cont|cross|dateT|en export const SVG_CAMEL_CASE = /^ac|^ali|arabic|basel|cap|clipPath$|clipRule$|color|dominant|enable|fill|flood|font|glyph[^R]|horiz|image|letter|lighting|marker[^WUH]|overline|panose|pointe|paint|rendering|shape|stop|strikethrough|stroke|text[^L]|transform|underline|unicode|units|^v[^i]|^w|^xH/; // DOM properties that should NOT have "px" added when numeric -const ENCODED_ENTITIES = /["&<]/; +const ENCODED_ENTITIES = /["'&<]/; /** @param {string} str */ export function encodeEntities(str) { @@ -26,6 +26,9 @@ export function encodeEntities(str) { case 38: ch = '&'; break; + case 39: + ch = '''; + break; case 60: ch = '<'; break; diff --git a/test/render.test.js b/test/render.test.js index e6b6fe1c..050b6388 100644 --- a/test/render.test.js +++ b/test/render.test.js @@ -213,8 +213,8 @@ describe('render', () => { }); it('should encode entities', () => { - let rendered = render(
&'}>{'"<>&'}
), - expected = `
"<>&
`; + let rendered = render(
&'}>{'"\'<>&'}
), + expected = `
"'<>&
`; expect(rendered).to.equal(expected); });