fix(runtime-core): skip patching reserved props for custom elements #14275
Conversation
📝 WalkthroughWalkthroughHydration was adjusted to avoid applying reserved props (like Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested labels
Poem
Pre-merge checks and finishing touches✅ Passed checks (5 passed)
✨ Finishing touches
📜 Recent review detailsConfiguration used: defaults Review profile: CHILL Plan: Pro 📒 Files selected for processing (1)
🧰 Additional context used🧬 Code graph analysis (1)packages/runtime-core/__tests__/hydration.spec.ts (1)
🪛 ast-grep (0.40.3)packages/runtime-core/__tests__/hydration.spec.ts[warning] 1602-1602: Direct HTML content assignment detected. Modifying innerHTML, outerHTML, or using document.write with unsanitized content can lead to XSS vulnerabilities. Use secure alternatives like textContent or sanitize HTML with libraries like DOMPurify. (unsafe-html-content-assignment) [warning] 1602-1602: Direct modification of innerHTML or outerHTML properties detected. Modifying these properties with unsanitized user input can lead to XSS vulnerabilities. Use safe alternatives or sanitize content first. (dom-content-modification) ⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
🔇 Additional comments (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Size ReportBundles
Usages
|
@vue/compiler-core
@vue/compiler-dom
@vue/compiler-sfc
@vue/compiler-ssr
@vue/reactivity
@vue/runtime-core
@vue/runtime-dom
@vue/server-renderer
@vue/shared
vue
@vue/compat
commit: |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
packages/runtime-core/__tests__/hydration.spec.ts (1)
1600-1616: LGTM! Test correctly verifies the fix for issue #14274.The test appropriately verifies that reserved props (specifically
ref) are not rendered as attributes on custom elements during hydration. The test structure is sound and follows existing patterns in the file.Optional: Verify ref functionality still works
Consider adding an assertion to confirm the ref is correctly assigned, ensuring the fix doesn't break ref functionality:
app.mount(container) expect(container.innerHTML).toBe('<my-element>hello</my-element>') expect((container.firstChild as Element).hasAttribute('ref')).toBe(false) + expect(root.value).toBe(container.firstChild) })This would confirm both that the
refattribute is not added AND that the ref mechanism still functions correctly.Note: Static analysis warnings about
innerHTMLassignment are false positives in this test context—this is safe fixture setup with known HTML content.
📜 Review details
Configuration used: defaults
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
packages/runtime-core/__tests__/hydration.spec.ts
🧰 Additional context used
🧬 Code graph analysis (1)
packages/runtime-core/__tests__/hydration.spec.ts (1)
packages/runtime-dom/src/index.ts (1)
createSSRApp(148-165)
🪛 ast-grep (0.40.3)
packages/runtime-core/__tests__/hydration.spec.ts
[warning] 1602-1602: Direct modification of innerHTML or outerHTML properties detected. Modifying these properties with unsanitized user input can lead to XSS vulnerabilities. Use safe alternatives or sanitize content first.
Context: container.innerHTML = 'hello'
Note: [CWE-79] Improper Neutralization of Input During Web Page Generation [REFERENCES]
- https://owasp.org/www-community/xss-filter-evasion-cheatsheet
- https://cwe.mitre.org/data/definitions/79.html
(dom-content-modification)
[warning] 1602-1602: Direct HTML content assignment detected. Modifying innerHTML, outerHTML, or using document.write with unsanitized content can lead to XSS vulnerabilities. Use secure alternatives like textContent or sanitize HTML with libraries like DOMPurify.
Context: container.innerHTML = 'hello'
Note: [CWE-79] Improper Neutralization of Input During Web Page Generation [REFERENCES]
- https://www.dhairyashah.dev/posts/why-innerhtml-is-a-bad-idea-and-how-to-avoid-it/
- https://cwe.mitre.org/data/definitions/79.html
(unsafe-html-content-assignment)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: test / e2e-test
|
I don't believe the test failure is related as it passed on the previous commit, with no code changes edit: and now, the test failure is on the pkg.pr.new end |
|
/ecosystem-ci run |
edison1105
added
ready to merge
|
📝 Ran ecosystem CI: Open
|
|
Fix...
…On Sun, Jan 4, 2026, 4:59 PM Daniel Roe ***@***.***> wrote:
***@***.**** commented on this pull request.
------------------------------
In packages/runtime-core/__tests__/hydration.spec.ts
<#14275 (comment)>:
> @@ -1597,6 +1597,22 @@ describe('SSR hydration', () => {
expect((container.firstChild as any).foo).toBe(msg.value)
})
+ test('should not render ref on custom element during hydration', () => {
⬇️ Suggested change
- test('should not render ref on custom element during hydration', () => {
+ // #14274
+ test('should not render ref on custom element during hydration', () => {
—
Reply to this email directly, view it on GitHub
<#14275 (review)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/A4472ERCCL3IOZAB5DLFPAL4FEMEFAVCNFSM6AAAAACQUWD7KOVHI2DSMVQWIX3LMV43YUDVNRWFEZLROVSXG5CSMV3GSZLXHMZTMMRVGAZDAMJQG4>
.
You are receiving this because you are subscribed to this thread.Message
ID: ***@***.***>
|
4 participants
resolves #14274
resolves nuxt/nuxt#34016
we were not checking reserved props at hydration stage (even though we were when rendering in SSR)
Summary by CodeRabbit
Bug Fixes
Tests
✏️ Tip: You can customize this high-level summary in your review settings.