pyxle-framework 0.2.2__tar.gz → 0.2.3__tar.gz

{pyxle_framework-0.2.2 → pyxle_framework-0.2.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pyxle-framework
-Version: 0.2.2
+Version: 0.2.3
 Summary: Python-first full-stack framework with an intelligent CLI.
 Project-URL: Homepage, https://pyxle.dev
 Project-URL: Repository, https://github.com/pyxle-framework/pyxle

{pyxle_framework-0.2.2 → pyxle_framework-0.2.3}/docs/README.md

@@ -2,7 +2,7 @@
 
 Pyxle is a Python-first full-stack web framework that brings the Next.js developer experience to the Python ecosystem. Write server logic in Python, UI in React, and ship them together in `.pyxl` files.
 
-**Current version:** 0.2.2 (beta)
+**Current version:** 0.2.3 (beta)
 
 ---
 

{pyxle_framework-0.2.2 → pyxle_framework-0.2.3}/docs/faq.md

@@ -22,7 +22,7 @@ Django and Flask are backend frameworks that render templates. Pyxle is a full-s
 
 ### Is Pyxle production-ready?
 
-Pyxle is in **beta** (version 0.2.2). The core features are implemented and tested (1100+ tests, 95%+ coverage), but the API may change before 1.0. Use it for new projects and experiments, but be prepared for breaking changes.
+Pyxle is in **beta** (version 0.2.3). The core features are implemented and tested (1100+ tests, 95%+ coverage), but the API may change before 1.0. Use it for new projects and experiments, but be prepared for breaking changes.
 
 ### What Python version do I need?
 

{pyxle_framework-0.2.2 → pyxle_framework-0.2.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "pyxle-framework"
-version = "0.2.2"
+version = "0.2.3"
 description = "Python-first full-stack framework with an intelligent CLI."
 readme = "README.md"
 authors = [

{pyxle_framework-0.2.2 → pyxle_framework-0.2.3}/pyxle/ssr/_escape.py

@@ -15,13 +15,20 @@ from __future__ import annotations
 def escape_inline_json(value: str) -> str:
     """Escape *value* for safe inclusion inside an HTML ``<script>`` block.
 
-    The following replacements are applied:
+    Every replacement is chosen to break an HTML-tokenizer sequence while
+    staying **valid JSON**, so the output can still be placed inside a
+    ``<script type="application/json">`` block and parsed with ``JSON.parse``:
 
-    * ``</``    → ``<\\/``   — prevents premature ``</script>`` close
-    * ``<!--``  → ``<\\!--`` — prevents HTML comment opening
-    * ``-->``   → ``--\\>``  — prevents HTML comment closing
-    * U+2028    → ``\\u2028``— JS line separator (not valid in JSON strings)
-    * U+2029    → ``\\u2029``— JS paragraph separator
+    * ``</``    → ``<\\/``       — ``\\/`` is a valid JSON escape for ``/``
+    * ``<!--``  → ``\\u003c!--`` — ``\\u003c`` is the Unicode escape for ``<``
+    * ``-->``   → ``--\\u003e``  — ``\\u003e`` is the Unicode escape for ``>``
+    * U+2028    → ``\\u2028``    — JS line separator (not a newline in JSON)
+    * U+2029    → ``\\u2029``    — JS paragraph separator
+
+    The earlier implementation of the comment replacements used ``\\!`` and
+    ``\\>`` which are **not** valid JSON escape sequences and caused
+    ``JSON.parse`` to fail on pages whose props happened to contain
+    ``<!--`` or ``-->`` verbatim (e.g. docs pages embedding shell output).
 
     The input is expected to be the return value of :func:`json.dumps` or
     raw CSS text — **not** arbitrary HTML.
@@ -29,8 +36,8 @@ def escape_inline_json(value: str) -> str:
     return (
         value
         .replace("</", "<\\/")
-        .replace("<!--", "<\\!--")
-        .replace("-->", "--\\>")
+        .replace("<!--", "\\u003c!--")
+        .replace("-->", "--\\u003e")
         .replace("\u2028", "\\u2028")
         .replace("\u2029", "\\u2029")
     )

{pyxle_framework-0.2.2 → pyxle_framework-0.2.3}/tests/ssr/test_escape.py

@@ -1,5 +1,7 @@
 """Tests for pyxle.ssr._escape — inline-JSON escaping utilities."""
 
+import json
+
 import pytest
 
 from pyxle.ssr._escape import escape_inline_json
@@ -18,12 +20,12 @@ class TestEscapeInlineJson:
     def test_html_comment_open(self):
         result = escape_inline_json("<!-- comment -->")
         assert "<!--" not in result
-        assert "<\\!--" in result
+        assert "\\u003c!--" in result
 
     def test_html_comment_close(self):
         result = escape_inline_json("<!-- comment -->")
         assert "-->" not in result
-        assert "--\\>" in result
+        assert "--\\u003e" in result
 
     def test_unicode_line_separator(self):
         result = escape_inline_json('{"x":"\u2028"}')
@@ -55,11 +57,39 @@ class TestEscapeInlineJson:
         "input_val,expected_fragment",
         [
             ("</", "<\\/"),
-            ("<!--", "<\\!--"),
-            ("-->", "--\\>"),
+            ("<!--", "\\u003c!--"),
+            ("-->", "--\\u003e"),
             ("\u2028", "\\u2028"),
             ("\u2029", "\\u2029"),
         ],
     )
     def test_individual_replacements(self, input_val, expected_fragment):
         assert expected_fragment in escape_inline_json(input_val)
+
+    @pytest.mark.parametrize(
+        "payload",
+        [
+            {"raw": "--> shell prompt"},
+            {"raw": "<!-- html comment -->"},
+            {"raw": "</script><script>alert(1)</script>"},
+            {"raw": "line1\u2028line2"},
+            {"nested": {"list": ["-->", "<!--", "</script>"]}},
+            {"combo": "foo --> bar <!-- baz --> qux </script>"},
+        ],
+    )
+    def test_output_is_valid_json_after_escape(self, payload):
+        """Regression: the escaped output MUST still be parseable with
+        JSON.parse / json.loads, and it must round-trip to the original data.
+
+        Earlier versions replaced ``<!--`` with ``<\\!--`` and ``-->`` with
+        ``--\\>``, both of which are invalid JSON escape sequences — this
+        broke every docs page whose rendered content contained a literal
+        ``-->`` (e.g. shell output examples)."""
+        raw = json.dumps(payload, ensure_ascii=False)
+        escaped = escape_inline_json(raw)
+        # Must still parse, and must round-trip to the original data.
+        assert json.loads(escaped) == payload
+        # And none of the dangerous literal sequences survived.
+        assert "</" not in escaped or "<\\/" in escaped
+        assert "<!--" not in escaped
+        assert "-->" not in escaped