Don't execute <script> tags w/ createElement mode
Each script will execute at most once so we could also set `.textContent` to something like `;`, then add it to the document, then change the `.textContent`, but this seems like the simplest approach. See http://dev.w3.org/html5/spec-preview/the-script-element.html for details.
Ben Alpert committed
Oct 12, 2015 at 10:54 UTC
db989bf68648be636ff2201166c1b2ff482afe29
1 file changed
+10
-1
src/renderers/dom/shared/ReactDOMComponent.js
+10
-1
@@ -630,7 +630,16 @@ ReactDOMComponent.Mixin = {
630
var ownerDocument = nativeContainerInfo._ownerDocument;
631
var el;
632
if (namespaceURI === DOMNamespaces.html) {
633
- el = ownerDocument.createElement(this._currentElement.type);
633
+ if (this._tag === 'script') {
634
+ // Create the script via .innerHTML so its "parser-inserted" flag is
635
+ // set to true and it does not execute
636
+ var div = ownerDocument.createElement('div');
637
+ var type = this._currentElement.type;
638
+ div.innerHTML = `<${type}></${type}>`;
639
+ el = div.removeChild(div.firstChild);
640
+ } else {
641
+ el = ownerDocument.createElement(this._currentElement.type);
642
+ }
643
} else {
644
el = ownerDocument.createElementNS(
645
namespaceURI,