@samitouri / QOS-React-2 / commits / bcbeb52bf3

[Fizz] Disallow complex children in <title> elements (#24679)

* [Fizz] Disallow complex children in <title> elements <title> Elements in the DOM can only have Text content. In Fizz if more than one text node is emitted an HTML comment node is used as a text separator. Unfortunately because of the content restriction of the DOM representation of the title element this separator is displayed as escaped text which is not what the component author intended. This commit special cases title handling, primarily to issue warnings if you pass complex children to <title>. At the moment title expects to receive a single child or an array of length 1. In both cases the type of that child must be string or number. If anything more complex is provided a warning will be logged to the console explaining why this is problematic. There is no runtime behavior change so broken things are still broken (e.g. returning two text nodes which will cause a separator or using Suspense inside title children) but they should at least be accompanied by warnings that are useful. One edge case that will now warn but won't technically break an application is if you use a Component that returns a single string as a child of title. This is a form of indirection that works but becasue we cannot discriminate between a Component that will follow the rules and one that violates them the warning is issued regardless. * fixup dev warning conditional logic * lints * fix bugs

Josh Story committed Jun 7, 2022 at 03:33 UTC bcbeb52bf36c6f5ecdad46a48e87cf4354c5a64f
3 files changed +264 -1
packages/react-dom/src/__tests__/ReactDOMFizzServer-test.js
+191
@@ -4425,4 +4425,195 @@ describe('ReactDOMFizzServer', () => {
4425 );
4426 });
4427 });
4428 +
4429 + describe('title children', () => {
4430 + function prepareJSDOMForTitle() {
4431 + // Test Environment
4432 + const jsdom = new JSDOM('<!DOCTYPE html><html><head>\u0000', {
4433 + runScripts: 'dangerously',
4434 + });
4435 + window = jsdom.window;
4436 + document = jsdom.window.document;
4437 + container = document.getElementsByTagName('head')[0];
4438 + }
4439 +
4440 + // @gate experimental
4441 + it('should accept a single string child', async () => {
4442 + // a Single string child
4443 + function App() {
4444 + return <title>hello</title>;
4445 + }
4446 +
4447 + prepareJSDOMForTitle();
4448 + await act(async () => {
4449 + const {pipe} = ReactDOMFizzServer.renderToPipeableStream(<App />);
4450 + pipe(writable);
4451 + });
4452 + expect(getVisibleChildren(container)).toEqual(<title>hello</title>);
4453 +
4454 + const errors = [];
4455 + ReactDOMClient.hydrateRoot(container, <App />, {
4456 + onRecoverableError(error) {
4457 + errors.push(error.message);
4458 + },
4459 + });
4460 + expect(Scheduler).toFlushAndYield([]);
4461 + expect(errors).toEqual([]);
4462 + expect(getVisibleChildren(container)).toEqual(<title>hello</title>);
4463 + });
4464 +
4465 + // @gate experimental
4466 + it('should accept children array of length 1 containing a string', async () => {
4467 + // a Single string child
4468 + function App() {
4469 + return <title>{['hello']}</title>;
4470 + }
4471 +
4472 + prepareJSDOMForTitle();
4473 + await act(async () => {
4474 + const {pipe} = ReactDOMFizzServer.renderToPipeableStream(<App />);
4475 + pipe(writable);
4476 + });
4477 + expect(getVisibleChildren(container)).toEqual(<title>hello</title>);
4478 +
4479 + const errors = [];
4480 + ReactDOMClient.hydrateRoot(container, <App />, {
4481 + onRecoverableError(error) {
4482 + errors.push(error.message);
4483 + },
4484 + });
4485 + expect(Scheduler).toFlushAndYield([]);
4486 + expect(errors).toEqual([]);
4487 + expect(getVisibleChildren(container)).toEqual(<title>hello</title>);
4488 + });
4489 +
4490 + // @gate experimental
4491 + it('should warn in dev when given an array of length 2 or more', async () => {
4492 + const originalConsoleError = console.error;
4493 + const mockError = jest.fn();
4494 + console.error = (...args) => {
4495 + if (args.length > 1) {
4496 + if (typeof args[1] === 'object') {
4497 + mockError(args[0].split('\n')[0]);
4498 + return;
4499 + }
4500 + }
4501 + mockError(...args.map(normalizeCodeLocInfo));
4502 + };
4503 +
4504 + // a Single string child
4505 + function App() {
4506 + return <title>{['hello1', 'hello2']}</title>;
4507 + }
4508 +
4509 + try {
4510 + prepareJSDOMForTitle();
4511 +
4512 + await act(async () => {
4513 + const {pipe} = ReactDOMFizzServer.renderToPipeableStream(<App />);
4514 + pipe(writable);
4515 + });
4516 + if (__DEV__) {
4517 + expect(mockError).toHaveBeenCalledWith(
4518 + 'Warning: A title element received an array with more than 1 element as children. ' +
4519 + 'In browsers title Elements can only have Text Nodes as children. If ' +
4520 + 'the children being rendered output more than a single text node in aggregate the browser ' +
4521 + 'will display markup and comments as text in the title and hydration will likely fail and ' +
4522 + 'fall back to client rendering%s',
4523 + '\n' + ' in title (at **)\n' + ' in App (at **)',
4524 + );
4525 + } else {
4526 + expect(mockError).not.toHaveBeenCalled();
4527 + }
4528 +
4529 + expect(getVisibleChildren(container)).toEqual(
4530 + <title>{'hello1<!-- -->hello2'}</title>,
4531 + );
4532 +
4533 + const errors = [];
4534 + ReactDOMClient.hydrateRoot(container, <App />, {
4535 + onRecoverableError(error) {
4536 + errors.push(error.message);
4537 + },
4538 + });
4539 + expect(Scheduler).toFlushAndYield([]);
4540 + expect(errors).toEqual(
4541 + [
4542 + gate(flags => flags.enableClientRenderFallbackOnTextMismatch)
4543 + ? 'Text content does not match server-rendered HTML.'
4544 + : null,
4545 + 'Hydration failed because the initial UI does not match what was rendered on the server.',
4546 + 'There was an error while hydrating. Because the error happened outside of a Suspense boundary, the entire root will switch to client rendering.',
4547 + ].filter(Boolean),
4548 + );
4549 + expect(getVisibleChildren(container)).toEqual(
4550 + <title>{['hello1', 'hello2']}</title>,
4551 + );
4552 + } finally {
4553 + console.error = originalConsoleError;
4554 + }
4555 + });
4556 +
4557 + // @gate experimental
4558 + it('should warn in dev if you pass a React Component as a child to <title>', async () => {
4559 + const originalConsoleError = console.error;
4560 + const mockError = jest.fn();
4561 + console.error = (...args) => {
4562 + if (args.length > 1) {
4563 + if (typeof args[1] === 'object') {
4564 + mockError(args[0].split('\n')[0]);
4565 + return;
4566 + }
4567 + }
4568 + mockError(...args.map(normalizeCodeLocInfo));
4569 + };
4570 +
4571 + function IndirectTitle() {
4572 + return 'hello';
4573 + }
4574 +
4575 + function App() {
4576 + return (
4577 + <title>
4578 + <IndirectTitle />
4579 + </title>
4580 + );
4581 + }
4582 +
4583 + try {
4584 + prepareJSDOMForTitle();
4585 +
4586 + await act(async () => {
4587 + const {pipe} = ReactDOMFizzServer.renderToPipeableStream(<App />);
4588 + pipe(writable);
4589 + });
4590 + if (__DEV__) {
4591 + expect(mockError).toHaveBeenCalledWith(
4592 + 'Warning: A title element received a React element for children. ' +
4593 + 'In the browser title Elements can only have Text Nodes as children. If ' +
4594 + 'the children being rendered output more than a single text node in aggregate the browser ' +
4595 + 'will display markup and comments as text in the title and hydration will likely fail and ' +
4596 + 'fall back to client rendering%s',
4597 + '\n' + ' in title (at **)\n' + ' in App (at **)',
4598 + );
4599 + } else {
4600 + expect(mockError).not.toHaveBeenCalled();
4601 + }
4602 +
4603 + expect(getVisibleChildren(container)).toEqual(<title>hello</title>);
4604 +
4605 + const errors = [];
4606 + ReactDOMClient.hydrateRoot(container, <App />, {
4607 + onRecoverableError(error) {
4608 + errors.push(error.message);
4609 + },
4610 + });
4611 + expect(Scheduler).toFlushAndYield([]);
4612 + expect(errors).toEqual([]);
4613 + expect(getVisibleChildren(container)).toEqual(<title>hello</title>);
4614 + } finally {
4615 + console.error = originalConsoleError;
4616 + }
4617 + });
4618 + });
4619 });
packages/react-dom/src/server/ReactDOMServerFormatConfig.js
+71
@@ -1120,6 +1120,75 @@ function pushStartMenuItem(
1120 return null;
1121 }
1122
1123 +function pushStartTitle(
1124 + target: Array<Chunk | PrecomputedChunk>,
1125 + props: Object,
1126 + responseState: ResponseState,
1127 +): ReactNodeList {
1128 + target.push(startChunkForTag('title'));
1129 +
1130 + let children = null;
1131 + for (const propKey in props) {
1132 + if (hasOwnProperty.call(props, propKey)) {
1133 + const propValue = props[propKey];
1134 + if (propValue == null) {
1135 + continue;
1136 + }
1137 + switch (propKey) {
1138 + case 'children':
1139 + children = propValue;
1140 + break;
1141 + case 'dangerouslySetInnerHTML':
1142 + throw new Error(
1143 + '`dangerouslySetInnerHTML` does not make sense on <title>.',
1144 + );
1145 + // eslint-disable-next-line-no-fallthrough
1146 + default:
1147 + pushAttribute(target, responseState, propKey, propValue);
1148 + break;
1149 + }
1150 + }
1151 + }
1152 + target.push(endOfStartTag);
1153 +
1154 + if (__DEV__) {
1155 + const child =
1156 + Array.isArray(children) && children.length < 2
1157 + ? children[0] || null
1158 + : children;
1159 + if (Array.isArray(children) && children.length > 1) {
1160 + console.error(
1161 + 'A title element received an array with more than 1 element as children. ' +
1162 + 'In browsers title Elements can only have Text Nodes as children. If ' +
1163 + 'the children being rendered output more than a single text node in aggregate the browser ' +
1164 + 'will display markup and comments as text in the title and hydration will likely fail and ' +
1165 + 'fall back to client rendering',
1166 + );
1167 + } else if (child != null && child.$$typeof != null) {
1168 + console.error(
1169 + 'A title element received a React element for children. ' +
1170 + 'In the browser title Elements can only have Text Nodes as children. If ' +
1171 + 'the children being rendered output more than a single text node in aggregate the browser ' +
1172 + 'will display markup and comments as text in the title and hydration will likely fail and ' +
1173 + 'fall back to client rendering',
1174 + );
1175 + } else if (
1176 + child != null &&
1177 + typeof child !== 'string' &&
1178 + typeof child !== 'number'
1179 + ) {
1180 + console.error(
1181 + 'A title element received a value that was not a string or number for children. ' +
1182 + 'In the browser title Elements can only have Text Nodes as children. If ' +
1183 + 'the children being rendered output more than a single text node in aggregate the browser ' +
1184 + 'will display markup and comments as text in the title and hydration will likely fail and ' +
1185 + 'fall back to client rendering',
1186 + );
1187 + }
1188 + }
1189 + return children;
1190 +}
1191 +
1192 function pushStartGenericElement(
1193 target: Array<Chunk | PrecomputedChunk>,
1194 props: Object,
@@ -1390,6 +1459,8 @@ export function pushStartInstance(
1459 return pushInput(target, props, responseState);
1460 case 'menuitem':
1461 return pushStartMenuItem(target, props, responseState);
1462 + case 'title':
1463 + return pushStartTitle(target, props, responseState);
1464 // Newline eating tags
1465 case 'listing':
1466 case 'pre': {
scripts/error-codes/codes.json
+2 -1
@@ -418,5 +418,6 @@
418 "430": "ServerContext can only have a value prop and children. Found: %s",
419 "431": "React elements are not allowed in ServerContext",
420 "432": "This Suspense boundary was aborted by the server.",
421 - "433": "useId can only be used while React is rendering"
421 + "433": "useId can only be used while React is rendering",
422 + "434": "`dangerouslySetInnerHTML` does not make sense on <title>."
423 }