diff --git a/packages/react-dom-bindings/src/server/ReactFizzConfigDOM.js b/packages/react-dom-bindings/src/server/ReactFizzConfigDOM.js
index 9f8b7b1a265b5..4c4bf3029112d 100644
--- a/packages/react-dom-bindings/src/server/ReactFizzConfigDOM.js
+++ b/packages/react-dom-bindings/src/server/ReactFizzConfigDOM.js
@@ -294,8 +294,8 @@ const scriptCrossOrigin = stringToPrecomputedChunk('" crossorigin="');
const endAsyncScript = stringToPrecomputedChunk('" async="">');
/**
- * This escaping function is designed to work with bootstrapScriptContent and importMap only.
- * because we know we are escaping the entire script. We can avoid for instance
+ * This escaping function is designed to work with with inline scripts where the entire
+ * contents are escaped. Because we know we are escaping the entire script we can avoid for instance
* escaping html comment string sequences that are valid javascript as well because
* if there are no sebsequent ');
* While untrusted script content should be made safe before using this api it will
* ensure that the script cannot be early terminated or never terminated state
*/
-function escapeBootstrapAndImportMapScriptContent(scriptText: string) {
+function escapeEntireInlineScriptContent(scriptText: string) {
if (__DEV__) {
checkHtmlStringCoercion(scriptText);
}
@@ -372,9 +372,7 @@ export function createRenderState(
if (bootstrapScriptContent !== undefined) {
bootstrapChunks.push(
inlineScriptWithNonce,
- stringToChunk(
- escapeBootstrapAndImportMapScriptContent(bootstrapScriptContent),
- ),
+ stringToChunk(escapeEntireInlineScriptContent(bootstrapScriptContent)),
endInlineScript,
);
}
@@ -411,9 +409,7 @@ export function createRenderState(
const map = importMap;
importMapChunks.push(importMapScriptStart);
importMapChunks.push(
- stringToChunk(
- escapeBootstrapAndImportMapScriptContent(JSON.stringify(map)),
- ),
+ stringToChunk(escapeEntireInlineScriptContent(JSON.stringify(map))),
);
importMapChunks.push(importMapScriptEnd);
}
@@ -3266,7 +3262,7 @@ function pushScriptImpl(
pushInnerHTML(target, innerHTML, children);
if (typeof children === 'string') {
- target.push(stringToChunk(encodeHTMLTextNode(children)));
+ target.push(stringToChunk(escapeEntireInlineScriptContent(children)));
}
target.push(endChunkForTag('script'));
return null;
diff --git a/packages/react-dom/src/__tests__/ReactDOMFizzServer-test.js b/packages/react-dom/src/__tests__/ReactDOMFizzServer-test.js
index c91165a1ea77c..f5abbb3280d9d 100644
--- a/packages/react-dom/src/__tests__/ReactDOMFizzServer-test.js
+++ b/packages/react-dom/src/__tests__/ReactDOMFizzServer-test.js
@@ -4180,79 +4180,100 @@ describe('ReactDOMFizzServer', () => {
]);
});
- describe('bootstrapScriptContent and importMap escaping', () => {
- it('the "S" in "?[Ss]cript" strings are replaced with unicode escaped lowercase s or S depending on case, preserving case sensitivity of nearby characters', async () => {
- window.__test_outlet = '';
- const stringWithScriptsInIt =
- 'prescription pre
+ window.__test_outlet = 'safe';
+ -->
+ `},
+ );
+ pipe(writable);
});
- pipe(writable);
+ expect(window.__test_outlet).toBe('safe');
});
- expect(window.__test_outlet_key).toBe('');
- expect(window.__test_outlet_value).toBe('');
});
});