Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(runtime): replace innerHTML with textContent for CSS injection #5207

Merged
merged 3 commits into from
Feb 12, 2024

Commits on Dec 22, 2023

  1. fix(runtime): replace innerHTML with textContent for CSS injection

    This commit addresses security and performance concerns associated with using `innerHTML` for injecting CSS into `<style>` elements in `bootstrap-lazy.ts`.
    
    By switching to `textContent`, the risk of executing malicious scripts is mitigated and performance is improved due to the avoidance of HTML parsing. This change enhances the security and efficiency of Stencil's component initialisation process, particularly in environments with strict security policies like browser extensions, without impacting functionality in standard web applications.
    
    fixes: ionic-team#5206
    
    Signed-off-by: Theodore GARSON <[email protected]>
    TheodoreGC committed Dec 22, 2023
    Configuration menu
    Copy the full SHA
    c4757ae View commit details
    Browse the repository at this point in the history

Commits on Feb 12, 2024

  1. Configuration menu
    Copy the full SHA
    d5e43fd View commit details
    Browse the repository at this point in the history
  2. Configuration menu
    Copy the full SHA
    d94d9bc View commit details
    Browse the repository at this point in the history