fix(astro): Fix `isHTMLString` check failing in multi-realm environments by rururux · Pull Request #16142 · withastro/astro

rururux · 2026-03-29T11:26:49Z

Changes

When using the Astro Container API, passing child elements to a component inside an MDX file could cause those elements to be incorrectly escaped.
This happened because the value instanceof HTMLString check in the isHTMLString function failed to recognize the HTMLString instance correctly.

astro/packages/astro/src/runtime/server/escape.ts

Lines 50 to 52 in 0d24e3b

    
           export function isHTMLString(value: any): value is HTMLString { 
        
           	return value instanceof HTMLString; 
        
           }

(if(isHTMLString(child)) does not evaluate to true, so the program proceeds to the next if statement)

Following Erika’s suggestion, I have updated the logic to check for the presence of Symbol.for('astro:html-string') instead of using instanceof HTMLString.

Testing

Added a test to verify that child elements passed to a component inside an MDX file are not incorrectly escaped.

Docs

N/A, bug fix

changeset-bot · 2026-03-29T11:26:55Z

🦋 Changeset detected

Latest commit: e97d963

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

codspeed-hq · 2026-03-29T11:44:26Z

Merging this PR will not alter performance

✅ 18 untouched benchmarks

_{Comparing rururux:mdx-escape-issue (e97d963) with main (a7e7567)}

packages/astro/src/runtime/server/escape.ts

rururux · 2026-03-31T08:58:28Z

I’ve made a few changes.

Following Erika’s suggestion, I’ve changed the method to use Symbol.for(...) for the check instead of Symbol.toStringTag.
As a result, Symbol.toStringTag is no longer used in the HTMLString class, so I’ve removed it.
I found a check for value instanceof HTMLString in markHTMLString, so I changed it to use isHTMLString instead.
I’ve simplified the structure of the test fixture. I’ve confirmed that the test fails as it did with the previous test fixture before the change to the isHTMLString check logic.

Princesseuh · 2026-03-31T09:27:14Z

Did you get to see if adding virtual: to the server-app module name fixes this without requiring changes to HTMLString?

rururux · 2026-03-31T10:51:10Z

I just tested this, and confirmed that even if I change ASTRO_DEV_SERVER_APP_ID to "virtual:astro:server-app", the tests I added this time will not pass unless I apply this PRs change.
I also confirmed that the error with the <Steps> component we discussed on Discord still occurs without this change.

~~However, regarding the <Steps> component, HMR stopped working properly after this error and the astro:server-app error were resolved, so the issue hasn’t been fully resolved.~~

rururux · 2026-03-31T11:35:24Z

It seems that HMR not working when editing MDX files is by design, my apologies.
So, I think the issue with the <Steps> component can be fixed simply by applying the changes in this PR and updating “virtual:astro:server-app”.

rururux · 2026-04-01T13:12:19Z

Just to follow up on the HMR mention, by "HMR," I specifically meant changes being applied without a full page reload.
The automatic full reload is still working perfectly fine, so there's no issue with the changes being applied.

packages/astro/src/runtime/server/escape.ts

ematipico · 2026-04-01T13:44:28Z

.changeset/jolly-ideas-sell.md

+'astro': patch
+---
+
+Fix HTML escaping in `renderToString` for MDX slots during build


Can you reword the changeset to be more user-centric? https://contribute.docs.astro.build/docs-for-code-changes/changesets/#tips-and-examples

I've updated the changeset. does this look good to you?

ematipico · 2026-04-01T15:20:25Z

.changeset/jolly-ideas-sell.md

+'astro': patch
+---
+
+Fixes HTML content being incorrectly escaped as plain text due to a failed `isHTMLString` check


Suggested change

Fixes HTML content being incorrectly escaped as plain text due to a failed `isHTMLString` check

Fixes HTML content being incorrectly escaped as plain text when rendering a MDX component using the `AstroContainer` APIs.

cc @rururux for future reference

I appreciate you tidying that up for me. Thanks for the reference!

rururux · 2026-04-01T15:32:47Z

Thank you! ☺️

fix(container): don't escape slot HTML in renderToString during build

4d2ab05

github-actions bot added pkg: integration Related to any renderer integration (scope) pkg: astro Related to the core `astro` package (scope) labels Mar 29, 2026

rururux added 2 commits March 29, 2026 21:09

performance issue

a375995

oops

ae1a48b

Princesseuh reviewed Mar 30, 2026

View reviewed changes

packages/astro/src/runtime/server/escape.ts Outdated Show resolved Hide resolved

rururux added 6 commits March 31, 2026 17:21

apply Erika's suggestion

9208800

use isHTMLString within markHTMLString

a023285

simplify test fixtures

1ff1de2

format

b6724c6

remove the no longer used Symbol.toStringTag from HTMLString

e02f949

Merge branch 'main' into mdx-escape-issue

98bd4fe

rururux changed the title ~~fix(container): don't escape slot HTML in renderToString during build~~ fix(astro): Fix isHTMLString check failing in multi-realm environments Mar 31, 2026

Merge branch 'main' into mdx-escape-issue

047a96d

ematipico reviewed Apr 1, 2026

View reviewed changes

rururux added 2 commits April 1, 2026 23:21

rename to htmlStringSymbol

0483c18

update changeset

f0f0ee0

ematipico approved these changes Apr 1, 2026

View reviewed changes

ematipico reviewed Apr 1, 2026

View reviewed changes

Apply suggestion from @ematipico

e97d963

ematipico merged commit 7454854 into withastro:main Apr 1, 2026
12 checks passed

astrobot-houston mentioned this pull request Apr 1, 2026

[ci] release #16159

Merged

rururux deleted the mdx-escape-issue branch April 1, 2026 15:32

	export function isHTMLString(value: any): value is HTMLString {
	return value instanceof HTMLString;
	}

	Fixes HTML content being incorrectly escaped as plain text due to a failed `isHTMLString` check
	Fixes HTML content being incorrectly escaped as plain text when rendering a MDX component using the `AstroContainer` APIs.

Uh oh!

Conversation

rururux commented Mar 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Testing

Docs

Uh oh!

changeset-bot bot commented Mar 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

codspeed-hq bot commented Mar 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will not alter performance

Uh oh!

Uh oh!

rururux commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Princesseuh commented Mar 31, 2026

Uh oh!

rururux commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rururux commented Mar 31, 2026

Uh oh!

rururux commented Apr 1, 2026

Uh oh!

Uh oh!

ematipico Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rururux Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

ematipico Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rururux Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

rururux commented Apr 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

rururux commented Mar 29, 2026 •

edited

Loading

changeset-bot bot commented Mar 29, 2026 •

edited

Loading

codspeed-hq bot commented Mar 29, 2026 •

edited

Loading

rururux commented Mar 31, 2026 •

edited

Loading

rururux commented Mar 31, 2026 •

edited

Loading

ematipico Apr 1, 2026 •

edited

Loading

ematipico Apr 1, 2026 •

edited

Loading