Skip to content

Commit bcbeb52

Browse files
gnoffgnoff
authored
[Fizz] Disallow complex children in <title> elements (#24679)
* [Fizz] Disallow complex children in <title> elements <title> Elements in the DOM can only have Text content. In Fizz if more than one text node is emitted an HTML comment node is used as a text separator. Unfortunately because of the content restriction of the DOM representation of the title element this separator is displayed as escaped text which is not what the component author intended. This commit special cases title handling, primarily to issue warnings if you pass complex children to <title>. At the moment title expects to receive a single child or an array of length 1. In both cases the type of that child must be string or number. If anything more complex is provided a warning will be logged to the console explaining why this is problematic. There is no runtime behavior change so broken things are still broken (e.g. returning two text nodes which will cause a separator or using Suspense inside title children) but they should at least be accompanied by warnings that are useful. One edge case that will now warn but won't technically break an application is if you use a Component that returns a single string as a child of title. This is a form of indirection that works but becasue we cannot discriminate between a Component that will follow the rules and one that violates them the warning is issued regardless. * fixup dev warning conditional logic * lints * fix bugs
1 parent 4f29ba1 commit bcbeb52

File tree

3 files changed

+264
-1
lines changed

3 files changed

+264
-1
lines changed

‎packages/react-dom/src/__tests__/ReactDOMFizzServer-test.js

+191
Original file line numberDiff line numberDiff line change
@@ -4425,4 +4425,195 @@ describe('ReactDOMFizzServer', () => {
44254425
);
44264426
});
44274427
});
4428+
4429+
describe('title children', () => {
4430+
function prepareJSDOMForTitle() {
4431+
// Test Environment
4432+
const jsdom = new JSDOM('<!DOCTYPE html><html><head>\u0000', {
4433+
runScripts: 'dangerously',
4434+
});
4435+
window = jsdom.window;
4436+
document = jsdom.window.document;
4437+
container = document.getElementsByTagName('head')[0];
4438+
}
4439+
4440+
// @gate experimental
4441+
it('should accept a single string child', async () => {
4442+
// a Single string child
4443+
function App() {
4444+
return <title>hello</title>;
4445+
}
4446+
4447+
prepareJSDOMForTitle();
4448+
await act(async () => {
4449+
const {pipe} = ReactDOMFizzServer.renderToPipeableStream(<App />);
4450+
pipe(writable);
4451+
});
4452+
expect(getVisibleChildren(container)).toEqual(<title>hello</title>);
4453+
4454+
const errors = [];
4455+
ReactDOMClient.hydrateRoot(container, <App />, {
4456+
onRecoverableError(error) {
4457+
errors.push(error.message);
4458+
},
4459+
});
4460+
expect(Scheduler).toFlushAndYield([]);
4461+
expect(errors).toEqual([]);
4462+
expect(getVisibleChildren(container)).toEqual(<title>hello</title>);
4463+
});
4464+
4465+
// @gate experimental
4466+
it('should accept children array of length 1 containing a string', async () => {
4467+
// a Single string child
4468+
function App() {
4469+
return <title>{['hello']}</title>;
4470+
}
4471+
4472+
prepareJSDOMForTitle();
4473+
await act(async () => {
4474+
const {pipe} = ReactDOMFizzServer.renderToPipeableStream(<App />);
4475+
pipe(writable);
4476+
});
4477+
expect(getVisibleChildren(container)).toEqual(<title>hello</title>);
4478+
4479+
const errors = [];
4480+
ReactDOMClient.hydrateRoot(container, <App />, {
4481+
onRecoverableError(error) {
4482+
errors.push(error.message);
4483+
},
4484+
});
4485+
expect(Scheduler).toFlushAndYield([]);
4486+
expect(errors).toEqual([]);
4487+
expect(getVisibleChildren(container)).toEqual(<title>hello</title>);
4488+
});
4489+
4490+
// @gate experimental
4491+
it('should warn in dev when given an array of length 2 or more', async () => {
4492+
const originalConsoleError = console.error;
4493+
const mockError = jest.fn();
4494+
console.error = (...args) => {
4495+
if (args.length > 1) {
4496+
if (typeof args[1] === 'object') {
4497+
mockError(args[0].split('\n')[0]);
4498+
return;
4499+
}
4500+
}
4501+
mockError(...args.map(normalizeCodeLocInfo));
4502+
};
4503+
4504+
// a Single string child
4505+
function App() {
4506+
return <title>{['hello1', 'hello2']}</title>;
4507+
}
4508+
4509+
try {
4510+
prepareJSDOMForTitle();
4511+
4512+
await act(async () => {
4513+
const {pipe} = ReactDOMFizzServer.renderToPipeableStream(<App />);
4514+
pipe(writable);
4515+
});
4516+
if (__DEV__) {
4517+
expect(mockError).toHaveBeenCalledWith(
4518+
'Warning: A title element received an array with more than 1 element as children. ' +
4519+
'In browsers title Elements can only have Text Nodes as children. If ' +
4520+
'the children being rendered output more than a single text node in aggregate the browser ' +
4521+
'will display markup and comments as text in the title and hydration will likely fail and ' +
4522+
'fall back to client rendering%s',
4523+
'\n' + ' in title (at **)\n' + ' in App (at **)',
4524+
);
4525+
} else {
4526+
expect(mockError).not.toHaveBeenCalled();
4527+
}
4528+
4529+
expect(getVisibleChildren(container)).toEqual(
4530+
<title>{'hello1<!-- -->hello2'}</title>,
4531+
);
4532+
4533+
const errors = [];
4534+
ReactDOMClient.hydrateRoot(container, <App />, {
4535+
onRecoverableError(error) {
4536+
errors.push(error.message);
4537+
},
4538+
});
4539+
expect(Scheduler).toFlushAndYield([]);
4540+
expect(errors).toEqual(
4541+
[
4542+
gate(flags => flags.enableClientRenderFallbackOnTextMismatch)
4543+
? 'Text content does not match server-rendered HTML.'
4544+
: null,
4545+
'Hydration failed because the initial UI does not match what was rendered on the server.',
4546+
'There was an error while hydrating. Because the error happened outside of a Suspense boundary, the entire root will switch to client rendering.',
4547+
].filter(Boolean),
4548+
);
4549+
expect(getVisibleChildren(container)).toEqual(
4550+
<title>{['hello1', 'hello2']}</title>,
4551+
);
4552+
} finally {
4553+
console.error = originalConsoleError;
4554+
}
4555+
});
4556+
4557+
// @gate experimental
4558+
it('should warn in dev if you pass a React Component as a child to <title>', async () => {
4559+
const originalConsoleError = console.error;
4560+
const mockError = jest.fn();
4561+
console.error = (...args) => {
4562+
if (args.length > 1) {
4563+
if (typeof args[1] === 'object') {
4564+
mockError(args[0].split('\n')[0]);
4565+
return;
4566+
}
4567+
}
4568+
mockError(...args.map(normalizeCodeLocInfo));
4569+
};
4570+
4571+
function IndirectTitle() {
4572+
return 'hello';
4573+
}
4574+
4575+
function App() {
4576+
return (
4577+
<title>
4578+
<IndirectTitle />
4579+
</title>
4580+
);
4581+
}
4582+
4583+
try {
4584+
prepareJSDOMForTitle();
4585+
4586+
await act(async () => {
4587+
const {pipe} = ReactDOMFizzServer.renderToPipeableStream(<App />);
4588+
pipe(writable);
4589+
});
4590+
if (__DEV__) {
4591+
expect(mockError).toHaveBeenCalledWith(
4592+
'Warning: A title element received a React element for children. ' +
4593+
'In the browser title Elements can only have Text Nodes as children. If ' +
4594+
'the children being rendered output more than a single text node in aggregate the browser ' +
4595+
'will display markup and comments as text in the title and hydration will likely fail and ' +
4596+
'fall back to client rendering%s',
4597+
'\n' + ' in title (at **)\n' + ' in App (at **)',
4598+
);
4599+
} else {
4600+
expect(mockError).not.toHaveBeenCalled();
4601+
}
4602+
4603+
expect(getVisibleChildren(container)).toEqual(<title>hello</title>);
4604+
4605+
const errors = [];
4606+
ReactDOMClient.hydrateRoot(container, <App />, {
4607+
onRecoverableError(error) {
4608+
errors.push(error.message);
4609+
},
4610+
});
4611+
expect(Scheduler).toFlushAndYield([]);
4612+
expect(errors).toEqual([]);
4613+
expect(getVisibleChildren(container)).toEqual(<title>hello</title>);
4614+
} finally {
4615+
console.error = originalConsoleError;
4616+
}
4617+
});
4618+
});
44284619
});

‎packages/react-dom/src/server/ReactDOMServerFormatConfig.js

+71
Original file line numberDiff line numberDiff line change
@@ -1120,6 +1120,75 @@ function pushStartMenuItem(
11201120
return null;
11211121
}
11221122

1123+
function pushStartTitle(
1124+
target: Array<Chunk | PrecomputedChunk>,
1125+
props: Object,
1126+
responseState: ResponseState,
1127+
): ReactNodeList {
1128+
target.push(startChunkForTag('title'));
1129+
1130+
let children = null;
1131+
for (const propKey in props) {
1132+
if (hasOwnProperty.call(props, propKey)) {
1133+
const propValue = props[propKey];
1134+
if (propValue == null) {
1135+
continue;
1136+
}
1137+
switch (propKey) {
1138+
case 'children':
1139+
children = propValue;
1140+
break;
1141+
case 'dangerouslySetInnerHTML':
1142+
throw new Error(
1143+
'`dangerouslySetInnerHTML` does not make sense on <title>.',
1144+
);
1145+
// eslint-disable-next-line-no-fallthrough
1146+
default:
1147+
pushAttribute(target, responseState, propKey, propValue);
1148+
break;
1149+
}
1150+
}
1151+
}
1152+
target.push(endOfStartTag);
1153+
1154+
if (__DEV__) {
1155+
const child =
1156+
Array.isArray(children) && children.length < 2
1157+
? children[0] || null
1158+
: children;
1159+
if (Array.isArray(children) && children.length > 1) {
1160+
console.error(
1161+
'A title element received an array with more than 1 element as children. ' +
1162+
'In browsers title Elements can only have Text Nodes as children. If ' +
1163+
'the children being rendered output more than a single text node in aggregate the browser ' +
1164+
'will display markup and comments as text in the title and hydration will likely fail and ' +
1165+
'fall back to client rendering',
1166+
);
1167+
} else if (child != null && child.$$typeof != null) {
1168+
console.error(
1169+
'A title element received a React element for children. ' +
1170+
'In the browser title Elements can only have Text Nodes as children. If ' +
1171+
'the children being rendered output more than a single text node in aggregate the browser ' +
1172+
'will display markup and comments as text in the title and hydration will likely fail and ' +
1173+
'fall back to client rendering',
1174+
);
1175+
} else if (
1176+
child != null &&
1177+
typeof child !== 'string' &&
1178+
typeof child !== 'number'
1179+
) {
1180+
console.error(
1181+
'A title element received a value that was not a string or number for children. ' +
1182+
'In the browser title Elements can only have Text Nodes as children. If ' +
1183+
'the children being rendered output more than a single text node in aggregate the browser ' +
1184+
'will display markup and comments as text in the title and hydration will likely fail and ' +
1185+
'fall back to client rendering',
1186+
);
1187+
}
1188+
}
1189+
return children;
1190+
}
1191+
11231192
function pushStartGenericElement(
11241193
target: Array<Chunk | PrecomputedChunk>,
11251194
props: Object,
@@ -1390,6 +1459,8 @@ export function pushStartInstance(
13901459
return pushInput(target, props, responseState);
13911460
case 'menuitem':
13921461
return pushStartMenuItem(target, props, responseState);
1462+
case 'title':
1463+
return pushStartTitle(target, props, responseState);
13931464
// Newline eating tags
13941465
case 'listing':
13951466
case 'pre': {

‎scripts/error-codes/codes.json

+2-1
Original file line numberDiff line numberDiff line change
@@ -418,5 +418,6 @@
418418
"430": "ServerContext can only have a value prop and children. Found: %s",
419419
"431": "React elements are not allowed in ServerContext",
420420
"432": "This Suspense boundary was aborted by the server.",
421-
"433": "useId can only be used while React is rendering"
421+
"433": "useId can only be used while React is rendering",
422+
"434": "`dangerouslySetInnerHTML` does not make sense on <title>."
422423
}

0 commit comments

Comments
 (0)