Nathan Nguyen 7bcbe94a25 fix(script): reject event attributes in hoisted HTML (#2763) ...

App Router hoisting manually serializes beforeInteractive Script props, bypassing React DOM filtering for string-valued event handlers. Request-influenced on* props could therefore become executable inline attributes in the server response.\n\nReject event-handler names case-insensitively at the raw HTML emission boundary while preserving legitimate attributes such as data-onload. The regression test exercises the actual Script capture and hoisted render path.

Co-authored-by: James <james@eli.cx>

2026-08-03 14:26:42 +01:00

30 KiB

Raw Permalink Blame History

View Raw