Fix errors, bugs and known vulerabilities

This commit is contained in:
2026-03-23 06:58:41 +01:00
parent 0308ea32ec
commit 567fb4f746
15 changed files with 84 additions and 52 deletions
@@ -61,9 +61,11 @@ export default async function genWebHTML({
html += ` <link rel="stylesheet" href="/${bundledMap.css_path}" />\n`;
}
html += ` <script>window.${ClientWindowPagePropsName} = ${
EJSON.stringify(pageProps || {}) || "{}"
}</script>\n`;
const serializedProps = (EJSON.stringify(pageProps || {}) || "{}").replace(
/<\//g,
"<\\/",
);
html += ` <script>window.${ClientWindowPagePropsName} = ${serializedProps}</script>\n`;
if (bundledMap?.path) {
const dev = isDevelopment();
@@ -1,7 +1,6 @@
import type { FC } from "react";
import grabDirNames from "../../../utils/grab-dir-names";
import type {
BundlerCTXMap,
BunextPageModule,
BunxRouteParams,
GrabPageComponentRes,
@@ -34,7 +33,7 @@ export default async function grabPageErrorComponent({
const bundledMap = match?.filePath
? global.BUNDLER_CTX_MAP?.[match.filePath]
: ({} as BundlerCTXMap);
: undefined;
const module: BunextPageModule = await import(filePath);
const Component = module.default as FC<any>;
@@ -72,7 +71,7 @@ export default async function grabPageErrorComponent({
component: <DefaultNotFound />,
routeParams,
module: { default: DefaultNotFound },
bundledMap: {} as BundlerCTXMap,
bundledMap: undefined,
serverRes: {
responseOptions: {
status: is404 ? 404 : 500,
@@ -1,3 +1,4 @@
import { escape } from "lodash";
import type { BunextPageModuleMeta } from "../../../types";
type Params = {
@@ -8,68 +9,68 @@ export default function grabWebMetaHTML({ meta }: Params) {
let html = ``;
if (meta.title) {
html += ` <title>${meta.title}</title>\n`;
html += ` <title>${escape(meta.title)}</title>\n`;
}
if (meta.description) {
html += ` <meta name="description" content="${meta.description}" />\n`;
html += ` <meta name="description" content="${escape(meta.description)}" />\n`;
}
if (meta.keywords) {
const keywords = Array.isArray(meta.keywords)
? meta.keywords.join(", ")
: meta.keywords;
html += ` <meta name="keywords" content="${keywords}" />\n`;
html += ` <meta name="keywords" content="${escape(keywords)}" />\n`;
}
if (meta.author) {
html += ` <meta name="author" content="${meta.author}" />\n`;
html += ` <meta name="author" content="${escape(meta.author)}" />\n`;
}
if (meta.robots) {
html += ` <meta name="robots" content="${meta.robots}" />\n`;
html += ` <meta name="robots" content="${escape(meta.robots)}" />\n`;
}
if (meta.canonical) {
html += ` <link rel="canonical" href="${meta.canonical}" />\n`;
html += ` <link rel="canonical" href="${escape(meta.canonical)}" />\n`;
}
if (meta.themeColor) {
html += ` <meta name="theme-color" content="${meta.themeColor}" />\n`;
html += ` <meta name="theme-color" content="${escape(meta.themeColor)}" />\n`;
}
if (meta.og) {
const { og } = meta;
if (og.title)
html += ` <meta property="og:title" content="${og.title}" />\n`;
html += ` <meta property="og:title" content="${escape(og.title)}" />\n`;
if (og.description)
html += ` <meta property="og:description" content="${og.description}" />\n`;
html += ` <meta property="og:description" content="${escape(og.description)}" />\n`;
if (og.image)
html += ` <meta property="og:image" content="${og.image}" />\n`;
html += ` <meta property="og:image" content="${escape(og.image)}" />\n`;
if (og.url)
html += ` <meta property="og:url" content="${og.url}" />\n`;
html += ` <meta property="og:url" content="${escape(og.url)}" />\n`;
if (og.type)
html += ` <meta property="og:type" content="${og.type}" />\n`;
html += ` <meta property="og:type" content="${escape(og.type)}" />\n`;
if (og.siteName)
html += ` <meta property="og:site_name" content="${og.siteName}" />\n`;
html += ` <meta property="og:site_name" content="${escape(og.siteName)}" />\n`;
if (og.locale)
html += ` <meta property="og:locale" content="${og.locale}" />\n`;
html += ` <meta property="og:locale" content="${escape(og.locale)}" />\n`;
}
if (meta.twitter) {
const { twitter } = meta;
if (twitter.card)
html += ` <meta name="twitter:card" content="${twitter.card}" />\n`;
html += ` <meta name="twitter:card" content="${escape(twitter.card)}" />\n`;
if (twitter.title)
html += ` <meta name="twitter:title" content="${twitter.title}" />\n`;
html += ` <meta name="twitter:title" content="${escape(twitter.title)}" />\n`;
if (twitter.description)
html += ` <meta name="twitter:description" content="${twitter.description}" />\n`;
html += ` <meta name="twitter:description" content="${escape(twitter.description)}" />\n`;
if (twitter.image)
html += ` <meta name="twitter:image" content="${twitter.image}" />\n`;
html += ` <meta name="twitter:image" content="${escape(twitter.image)}" />\n`;
if (twitter.site)
html += ` <meta name="twitter:site" content="${twitter.site}" />\n`;
html += ` <meta name="twitter:site" content="${escape(twitter.site)}" />\n`;
if (twitter.creator)
html += ` <meta name="twitter:creator" content="${twitter.creator}" />\n`;
html += ` <meta name="twitter:creator" content="${escape(twitter.creator)}" />\n`;
}
return html;