@symbiotejs/symbiote 3.5.5 → 3.5.7

package/node/SSR.js

@@ -41,6 +41,30 @@ function extractCSS(sheet) {
   return text;
 }
 
+/**
+ * Check if a node is inside a <pre> or <code> ancestor.
+ * @param {Node} node
+ * @returns {boolean}
+ */
+function isInsidePreformatted(node) {
+  let el = node.parentElement;
+  while (el) {
+    let tag = el.localName;
+    if (tag === 'pre' || tag === 'code') return true;
+    el = el.parentElement;
+  }
+  return false;
+}
+
+/**
+ * Escape HTML special characters in text content.
+ * @param {string} text
+ * @returns {string}
+ */
+function escapeHtml(text) {
+  return text.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+}
+
 /**
  * Resolve {{prop}} text node tokens by reading values from the closest custom element.
  * @param {string} text
@@ -146,8 +170,9 @@ function serializeAttrs(el) {
  * @returns {string}
  */
 function serializeNode(node, emittedStyles, nonce) {
-  // Custom element — recurse:
-  if (node.nodeType === 1 && /** @type {Element} */ (node).localName?.includes('-')) {
+  let preformatted = isInsidePreformatted(node);
+  // Custom element — recurse (skip inside pre/code):
+  if (!preformatted && node.nodeType === 1 && /** @type {Element} */ (node).localName?.includes('-')) {
     return serializeElement(/** @type {HTMLElement} */ (node), emittedStyles, nonce);
   }
   // Regular element:
@@ -162,7 +187,8 @@ function serializeNode(node, emittedStyles, nonce) {
   }
   // Text node:
   if (node.nodeType === 3) {
-    return resolveTextTokens(node.textContent || '', node);
+    if (preformatted) return escapeHtml(node.textContent || '');
+    return resolveTextTokens(escapeHtml(node.textContent || ''), node);
   }
   // Comment:
   if (node.nodeType === 8) {
@@ -233,7 +259,9 @@ async function* streamElement(el, emittedStyles, nonce) {
  * @returns {AsyncGenerator<string>}
  */
 async function* streamNode(node, emittedStyles, nonce) {
-  if (node.nodeType === 1 && /** @type {Element} */ (node).localName?.includes('-')) {
+  let preformatted = isInsidePreformatted(node);
+  // Custom element — stream (skip inside pre/code):
+  if (!preformatted && node.nodeType === 1 && /** @type {Element} */ (node).localName?.includes('-')) {
     yield* streamElement(/** @type {HTMLElement} */ (node), emittedStyles, nonce);
     return;
   }
@@ -252,7 +280,11 @@ async function* streamNode(node, emittedStyles, nonce) {
     return;
   }
   if (node.nodeType === 3) {
-    yield resolveTextTokens(node.textContent || '', node);
+    if (preformatted) {
+      yield escapeHtml(node.textContent || '');
+    } else {
+      yield resolveTextTokens(escapeHtml(node.textContent || ''), node);
+    }
     return;
   }
   if (node.nodeType === 8) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "type": "module",
   "name": "@symbiotejs/symbiote",
-  "version": "3.5.5",
+  "version": "3.5.7",
   "description": "Symbiote.js - zero-dependency close-to-platform frontend library to build super-powered web components",
   "author": "team@rnd-pro.com",
   "license": "MIT",

package/types/node/SSR.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SSR.d.ts","sourceRoot":"","sources":["../../node/SSR.js"],"names":[],"mappings":"AAsQA;IAEE,8BAAmB;IACnB,8BAAmB;IAMnB;;;OAkEC;IAMD,uBAYC;IAkBD,yBAZW,MAAM,YACN;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAChB,OAAO,CAAC,MAAM,CAAC,CAgC3B;IAWD,+BALW,MAAM;;iBAEN;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAChB,MAAM,CAwBlB;IAWD,+BALW,MAAM;;iBAEN;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAChB,cAAc,CAAC,MAAM,CAAC,CAqBlC;CACF"}
+{"version":3,"file":"SSR.d.ts","sourceRoot":"","sources":["../../node/SSR.js"],"names":[],"mappings":"AAsSA;IAEE,8BAAmB;IACnB,8BAAmB;IAMnB;;;OAkEC;IAMD,uBAYC;IAkBD,yBAZW,MAAM,YACN;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAChB,OAAO,CAAC,MAAM,CAAC,CAgC3B;IAWD,+BALW,MAAM;;iBAEN;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAChB,MAAM,CAwBlB;IAWD,+BALW,MAAM;;iBAEN;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAChB,cAAc,CAAC,MAAM,CAAC,CAqBlC;CACF"}