@hackerrank/astra-cli 0.1.19 → 0.1.20

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/package.json +1 -1
  2. package/src/report.js +10 -1
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@hackerrank/astra-cli",
3
- "version": "0.1.19",
3
+ "version": "0.1.20",
4
4
  "description": "Minimal zero-dependency AI coding agent for the HackerRank AI Gateway.",
5
5
  "type": "module",
6
6
  "bin": {
package/src/report.js CHANGED
@@ -260,7 +260,16 @@ export function buildSummary(runs) {
260
260
  export function renderReportHtml(summary) {
261
261
  const tplPath = new URL("./report.html", import.meta.url);
262
262
  const tpl = fs.readFileSync(tplPath, "utf8");
263
- const data = JSON.stringify(summary).replace(/</g, "\\u003c");
263
+ // The summary includes model trajectory text, which can contain arbitrary
264
+ // shell output. Escape HTML-sensitive characters before embedding JSON in a
265
+ // script block so a literal `</script>` cannot terminate it early.
266
+ const data = JSON.stringify(summary)
267
+ .replace(/</g, "\\u003c")
268
+ .replace(/>/g, "\\u003e")
269
+ .replace(/&/g, "\\u0026")
270
+ .replace(/[\u2028\u2029]/g, (character) =>
271
+ character === "\u2028" ? "\\u2028" : "\\u2029",
272
+ );
264
273
  if (!tpl.includes("/*__ASTRA_DATA__*/")) {
265
274
  throw new Error("src/report.html is missing the /*__ASTRA_DATA__*/ injection marker");
266
275
  }