fix(nuxt): escape HTML in development error page stack trace #33820

kTelyakov · 2025-12-04T18:26:07Z

🔗 Linked issue

📚 Description

The development error page (nuxt-error-page.vue) was not escaping the stack trace text before inserting it into HTML, which could lead to XSS if the error message contained malicious content like <script> tags.

bolt-new-by-stackblitz · 2025-12-04T18:26:10Z

Run & review this pull request in StackBlitz Codeflow.

coderabbitai · 2025-12-04T18:28:59Z

Walkthrough

Imported escapeHtml from @vue/shared (with an ESLint disable comment) and used it to sanitise each stack trace line before rendering (replacing direct i.text with escapeHtml(i.text)). Stacktrace construction is now performed only in development builds (computed when import.meta.dev is true); in non‑dev builds it is left empty. No exported or public signatures were changed.

Pre-merge checks and finishing touches

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically describes the main change: escaping HTML in the development error page stack trace to fix XSS vulnerabilities.
Description check	✅ Passed	The description is directly related to the changeset, explaining the XSS vulnerability in the development error page and how the changes address it.
Linked Issues check	✅ Passed	The code changes directly address issue #33790 by escaping HTML in stack traces to prevent XSS, preserve error message text, and align with non-dev error page behaviour.
Out of Scope Changes check	✅ Passed	All changes are focused on escaping HTML in the error page component as per the linked issue requirements; no unrelated modifications are present.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 8eb6aff and bc49a73.

📒 Files selected for processing (1)

packages/nuxt/src/app/components/nuxt-error-page.vue (3 hunks)

🧰 Additional context used

📓 Path-based instructions (3)

**/*.{ts,tsx,vue}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

Follow standard TypeScript conventions and best practices

Files:

packages/nuxt/src/app/components/nuxt-error-page.vue

**/*.vue

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

Use <script setup lang="ts"> and the composition API when creating Vue components

Files:

packages/nuxt/src/app/components/nuxt-error-page.vue

**/*.{ts,tsx,js,jsx,vue}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

**/*.{ts,tsx,js,jsx,vue}: Use clear, descriptive variable and function names
Add comments only to explain complex logic or non-obvious implementations
Keep functions focused and manageable (generally under 50 lines), and extract complex logic into separate domain-specific files
Remove code that is not used or needed
Use error handling patterns consistently

Files:

packages/nuxt/src/app/components/nuxt-error-page.vue

🧠 Learnings (3)

📚 Learning: 2024-12-12T12:36:34.871Z

Learnt from: huang-julien
Repo: nuxt/nuxt PR: 29366
File: packages/nuxt/src/app/components/nuxt-root.vue:16-19
Timestamp: 2024-12-12T12:36:34.871Z
Learning: In `packages/nuxt/src/app/components/nuxt-root.vue`, when optimizing bundle size by conditionally importing components based on route metadata, prefer using inline conditional imports like:

```js
const IsolatedPage = route?.meta?.isolate ? defineAsyncComponent(() => import('#build/isolated-page.mjs')) : null
```

instead of wrapping the import in a computed property or importing the component unconditionally.

Applied to files:

packages/nuxt/src/app/components/nuxt-error-page.vue

📚 Learning: 2025-11-25T11:42:16.132Z

Learnt from: CR
Repo: nuxt/nuxt PR: 0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-11-25T11:42:16.132Z
Learning: Applies to **/*.{ts,tsx,js,jsx,vue} : Use error handling patterns consistently

Applied to files:

packages/nuxt/src/app/components/nuxt-error-page.vue

📚 Learning: 2025-11-25T11:42:16.132Z

Learnt from: CR
Repo: nuxt/nuxt PR: 0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-11-25T11:42:16.132Z
Learning: Applies to **/*.vue : Use `<script setup lang="ts">` and the composition API when creating Vue components

Applied to files:

packages/nuxt/src/app/components/nuxt-error-page.vue

🔇 Additional comments (3)

packages/nuxt/src/app/components/nuxt-error-page.vue (3)

7-8: LGTM: Import is appropriately guarded by usage.

The top-level import combined with the import.meta.dev guard on line 18 allows modern bundlers to tree-shake this dependency in production builds. The eslint disable comment is appropriate since @vue/shared provides the canonical implementation.

18-34: LGTM: Development guard effectively addresses past review concern.

The import.meta.dev guard ensures the stacktrace processing and escapeHtml usage are excluded from production builds, directly addressing the previous review comment about preventing production bundling.

33-33: LGTM: Correct XSS mitigation.

The escapeHtml function properly sanitises the stack trace text before rendering, preventing HTML injection whilst preserving the complete error message text. This directly addresses the security vulnerability described in the linked issue.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

pkg-pr-new · 2025-12-04T18:29:38Z

Open in StackBlitz

@nuxt/kit

npm i https://pkg.pr.new/@nuxt/kit@33820

@nuxt/nitro-server

npm i https://pkg.pr.new/@nuxt/nitro-server@33820

nuxt

npm i https://pkg.pr.new/nuxt@33820

@nuxt/rspack-builder

npm i https://pkg.pr.new/@nuxt/rspack-builder@33820

@nuxt/schema

npm i https://pkg.pr.new/@nuxt/schema@33820

@nuxt/vite-builder

npm i https://pkg.pr.new/@nuxt/vite-builder@33820

@nuxt/webpack-builder

npm i https://pkg.pr.new/@nuxt/webpack-builder@33820

commit: bc49a73

Fixes nuxt#33790 The stack trace text in the development error page was being inserted directly into HTML without escaping, which could lead to XSS if the error message contained malicious content. This change uses escapeHtml from vue to properly escape the stack trace text before inserting it into the HTML.

codspeed-hq · 2025-12-04T18:37:38Z

CodSpeed Performance Report

Merging #33820 will not alter performance

_{Comparing kTelyakov:fix/escape-error-page-xss (bc49a73) with main (08d9d2f)}

Summary

✅ 10 untouched

packages/nuxt/src/app/components/nuxt-error-page.vue

…-xss

danielroe

thank you ❤️

kTelyakov requested a review from danielroe as a code owner December 4, 2025 18:26

github-actions bot added 4.x bug labels Dec 4, 2025

kTelyakov force-pushed the fix/escape-error-page-xss branch from 5f0dd02 to a7d8d54 Compare December 4, 2025 19:57

danielroe reviewed Dec 8, 2025

View reviewed changes

packages/nuxt/src/app/components/nuxt-error-page.vue Show resolved Hide resolved

danielroe added 2 commits December 9, 2025 12:23

perf: guard escapeHtml for dev only

6c7a3f4

Merge remote-tracking branch 'origin/main' into fix/escape-error-page…

8eb6aff

…-xss

danielroe approved these changes Dec 9, 2025

View reviewed changes

danielroe changed the title ~~fix(nuxt): escape HTML in error page stack trace to prevent XSS~~ fix(nuxt): escape HTML in error page stack trace Dec 9, 2025

danielroe changed the title ~~fix(nuxt): escape HTML in error page stack trace~~ fix(nuxt): escape HTML in development error page stack trace Dec 9, 2025

fix: import from vue/shared

bc49a73

danielroe merged commit 9728d9e into nuxt:main Dec 9, 2025
55 checks passed

github-actions bot mentioned this pull request Dec 8, 2025

v4.2.2 #33687

Merged

danielroe pushed a commit that referenced this pull request Dec 9, 2025

fix(nuxt): escape HTML in development error page stack trace (#33820)

fd80e09

github-actions bot mentioned this pull request Dec 9, 2025

v3.20.2 #33696

Merged

coderabbitai bot mentioned this pull request Dec 19, 2025

Error stack highlights wrong line when an error is thrown in app #33917

Open

coderabbitai bot mentioned this pull request Jan 5, 2026

Using the v-if directive on <template> will cause HMR to fail. #34023

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(nuxt): escape HTML in development error page stack trace #33820

fix(nuxt): escape HTML in development error page stack trace #33820

Uh oh!

kTelyakov commented Dec 4, 2025

Uh oh!

bolt-new-by-stackblitz bot commented Dec 4, 2025

Uh oh!

coderabbitai bot commented Dec 4, 2025 •

edited

Loading

Uh oh!

pkg-pr-new bot commented Dec 4, 2025 •

edited

Loading

Uh oh!

codspeed-hq bot commented Dec 4, 2025 •

edited

Loading

Uh oh!

Uh oh!

danielroe left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

fix(nuxt): escape HTML in development error page stack trace #33820

fix(nuxt): escape HTML in development error page stack trace #33820

Uh oh!

Conversation

kTelyakov commented Dec 4, 2025

🔗 Linked issue

📚 Description

Uh oh!

bolt-new-by-stackblitz bot commented Dec 4, 2025

Uh oh!

coderabbitai bot commented Dec 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Pre-merge checks and finishing touches

Uh oh!

pkg-pr-new bot commented Dec 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codspeed-hq bot commented Dec 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CodSpeed Performance Report

Merging #33820 will not alter performance

Summary

Uh oh!

Uh oh!

danielroe left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coderabbitai bot commented Dec 4, 2025 •

edited

Loading

pkg-pr-new bot commented Dec 4, 2025 •

edited

Loading

codspeed-hq bot commented Dec 4, 2025 •

edited

Loading