From a31dec5eb30978cff7ff4d77f4bf316841f711bc Mon Sep 17 00:00:00 2001
From: Simon H <5968653+dummdidumm@users.noreply.github.com>
Date: Tue, 20 Jun 2023 17:45:53 +0200
Subject: [PATCH] Merge pull request from GHSA-gw32-9rmw-qwww

* rename previous test

* add new <textarea bind:value> test

* escape value in <textarea bind:value>

---------

Co-authored-by: Conduitry <git@chor.date>
---
 src/compiler/compile/render_ssr/handlers/Element.ts          | 2 +-
 .../_config.js                                               | 0
 test/runtime/samples/textarea-bind-value-escape/main.svelte  | 5 +++++
 test/runtime/samples/textarea-value-escape/_config.js        | 4 ++++
 .../{attribute-escape => textarea-value-escape}/main.svelte  | 0
 5 files changed, 10 insertions(+), 1 deletion(-)
 rename test/runtime/samples/{attribute-escape => textarea-bind-value-escape}/_config.js (100%)
 create mode 100644 test/runtime/samples/textarea-bind-value-escape/main.svelte
 create mode 100644 test/runtime/samples/textarea-value-escape/_config.js
 rename test/runtime/samples/{attribute-escape => textarea-value-escape}/main.svelte (100%)

diff --git a/src/compiler/compile/render_ssr/handlers/Element.ts b/src/compiler/compile/render_ssr/handlers/Element.ts
index d9254a7b86..41e862345a 100644
--- a/src/compiler/compile/render_ssr/handlers/Element.ts
+++ b/src/compiler/compile/render_ssr/handlers/Element.ts
@@ -149,7 +149,7 @@ export default function (node: Element, renderer: Renderer, options: RenderOptio
 			// value = name === 'textContent' ? x`@escape($$value)` : x`$$value`;
 		} else if (binding.name === 'value' && node.name === 'textarea') {
 			const snippet = expression.node;
-			node_contents = x`${snippet} || ""`;
+			node_contents = x`@escape(${snippet} || "")`;
 		} else if (binding.name === 'value' && node.name === 'select') {
 			// NOTE: do not add "value" attribute on <select />
 		} else {
diff --git a/test/runtime/samples/attribute-escape/_config.js b/test/runtime/samples/textarea-bind-value-escape/_config.js
similarity index 100%
rename from test/runtime/samples/attribute-escape/_config.js
rename to test/runtime/samples/textarea-bind-value-escape/_config.js
diff --git a/test/runtime/samples/textarea-bind-value-escape/main.svelte b/test/runtime/samples/textarea-bind-value-escape/main.svelte
new file mode 100644
index 0000000000..7bca8b8f58
--- /dev/null
+++ b/test/runtime/samples/textarea-bind-value-escape/main.svelte
@@ -0,0 +1,5 @@
+<script>
+	let value = `test'"></textarea><script>alert('BIM');</` + `script>`;
+</script>
+
+<textarea bind:value />
diff --git a/test/runtime/samples/textarea-value-escape/_config.js b/test/runtime/samples/textarea-value-escape/_config.js
new file mode 100644
index 0000000000..25313f01dc
--- /dev/null
+++ b/test/runtime/samples/textarea-value-escape/_config.js
@@ -0,0 +1,4 @@
+export default {
+	html: '<textarea></textarea>',
+	ssrHtml: '<textarea>test\'"&gt;&lt;/textarea&gt;&lt;script&gt;alert(\'BIM\');&lt;/script&gt;</textarea>'
+};
diff --git a/test/runtime/samples/attribute-escape/main.svelte b/test/runtime/samples/textarea-value-escape/main.svelte
similarity index 100%
rename from test/runtime/samples/attribute-escape/main.svelte
rename to test/runtime/samples/textarea-value-escape/main.svelte