-
Notifications
You must be signed in to change notification settings - Fork 1.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
\x3c within strings is replaced with <, causing script tags to be closed preemptively by the browser #1322
Comments
Parsing of I think whatever system you're using to inject the |
This is just unhandled. I'm actually surprised I haven't handled it yet since I'm already aware of the problem.
I think it's reasonable for esbuild to handle this case. Other JavaScript tools such as Terser already handle this. |
This leaves a weird edge case with tagged template literals: function printRaw(strings) {
console.log(strings.raw);
}
printRaw`</script>`; It's not possible to transform the |
Good point. I just added down-leveling for tagged template literals in this case. |
I have some code that renders a popup window including script tags, somewhat like this:
The \x3c is required because otherwise, when the browser parses the script that contains this string, it will close the script tag and the rest of the script will simply be rendered (in this case,
<div>something</div></body>
).Unfortunately esbuild replaces
\x3c
with<
:This of course breaks everything for us since all code that comes after
\x3c/script>
is simply not executed. I also tried to split the string into a concatenated version that the browser doesn't recognize, but of course esbuild optimizes this and transforms it back into a single string.It seems like this can be worked around by building a string array and joining it, but since this has to be done during runtime it's rather uncanny:
Is this expected or just an unhandled problem?
The text was updated successfully, but these errors were encountered: