@blocklet/pages-kit 0.5.37 → 0.5.38

package/lib/cjs/utils/preload.js

@@ -1,7 +1,27 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.safeJSONStringify = safeJSONStringify;
 exports.injectPreloadComponents = injectPreloadComponents;
 const types_1 = require("../types");
+/**
+ * Safely stringify JSON data to prevent XSS injection by escaping dangerous characters
+ * @param obj - The object to stringify
+ * @returns Safe JSON string with escaped characters
+ */
+function safeJSONStringify(obj) {
+    return JSON.stringify(obj).replace(/[<>/]/g, (char) => {
+        switch (char) {
+            case '<':
+                return '\\u003c';
+            case '>':
+                return '\\u003e';
+            case '/':
+                return '\\u002f';
+            default:
+                return char;
+        }
+    });
+}
 function injectPreloadComponents(data) {
     if (!data)
         return null;
@@ -14,9 +34,6 @@ function injectPreloadComponents(data) {
         })),
         instances: Object.fromEntries(data.instances.map(({ id, ...instance }) => [id, instance])),
     };
-    // Base64 encode the JSON data to prevent XSS injection
-    const jsonString = JSON.stringify(injectState);
-    const base64Data = Buffer.from(jsonString, 'utf8').toString('base64');
     return {
         html: `\
 ${Object.values(data.components)
@@ -28,7 +45,7 @@ ${script}
             .join('\n')}
   
 <script>
-var ${types_1.PreloadComponentsStateGlobalVariableName} = JSON.parse(atob('${base64Data}'));
+var ${types_1.PreloadComponentsStateGlobalVariableName} = ${safeJSONStringify(injectState)}
 </script>
 `,
     };