@lwrjs/shared-utils 0.23.4 → 0.23.6

package/build/cjs/serialize.cjs

@@ -28,6 +28,7 @@ __export(exports, {
   addToHead: () => addToHead,
   createHeadMarkup: () => createHeadMarkup,
   replaceStringFromLocation: () => replaceStringFromLocation,
+  serializeForScript: () => serializeForScript,
   serializeModuleToJson: () => serializeModuleToJson,
   shortestTtl: () => shortestTtl
 });
@@ -67,6 +68,16 @@ async function serializeModuleToJson(code = "", {
     code
   };
 }
+var SCRIPT_UNSAFE_ESCAPES = {
+  60: "\\u003c",
+  62: "\\u003e",
+  8232: "\\u2028",
+  8233: "\\u2029"
+};
+var SCRIPT_UNSAFE_CHARS_RE = /[<>\u2028\u2029]/g;
+function serializeForScript(value) {
+  return JSON.stringify(value).replace(SCRIPT_UNSAFE_CHARS_RE, (char) => SCRIPT_UNSAFE_ESCAPES[char.charCodeAt(0)]);
+}
 function replaceStringFromLocation(src, {startOffset, endOffset}, replaceValue) {
   return src.substr(0, startOffset) + replaceValue + src.substr(endOffset, src.length);
 }

package/build/es/serialize.d.ts

@@ -8,6 +8,22 @@ import type { HeadMarkup, LinkedModuleDefinition, LwrStringBuilder, ModuleJsonDe
  * @returns - Promise to the JSON serialization of the module
  */
 export declare function serializeModuleToJson(code: string | undefined, { specifier, version, ownHash, runtimeEnvironment, linkedConfig: { minified }, moduleRecord: { imports }, }: LinkedModuleDefinition, moduleRegistry: ModuleRegistry, runtimeParams: RuntimeParams): Promise<ModuleJsonDefinition>;
+/**
+ * JSON-serialize a value for safe embedding inside an inline HTML `<script>`
+ * element. For data purposes this is equivalent to `JSON.stringify(value)` — the
+ * output parses back to the identical value — but a string value can never break
+ * out of the surrounding `<script>` block.
+ *
+ * `<`, `>`, U+2028 and U+2029 never appear as JSON structural syntax (only inside
+ * string values), so escaping them on the serialized output cannot corrupt the
+ * JSON structure. The JS parser decodes each `\uXXXX` escape back to the original
+ * character, so a client that `JSON.parse`s (or evaluates) the result receives a
+ * byte-for-byte identical value.
+ *
+ * @param value - the value to serialize
+ * @returns a JSON string safe to inline in a `<script>` element
+ */
+export declare function serializeForScript(value: unknown): string;
 /**
  * Replace a part of a source string at the indices with a different value
  *

package/build/es/serialize.js

@@ -34,6 +34,46 @@ export async function serializeModuleToJson(code = '', { specifier, version, own
         code,
     };
 }
+/**
+ * Character codes that are legal inside a JSON string literal but unsafe when
+ * that JSON is embedded verbatim in an inline HTML `<script>` element. Each maps
+ * to its equivalent JS `\uXXXX` escape.
+ *
+ *  - U+003C `<` lets a value forge a `</script>` or `<!--` sequence and terminate
+ *    the script element early, injecting arbitrary HTML (CWE-79).
+ *  - U+003E `>` neutralizes `]]>` and HTML-comment close sequences (defense in depth).
+ *  - U+2028 / U+2029 are treated as line terminators by the JS parser and break
+ *    an inline script that contains them unescaped.
+ *
+ * Keyed by char code (and matched via `charCodeAt` below) so that no literal
+ * U+2028/U+2029 — invisible line terminators that would themselves break this
+ * source file — ever appears here.
+ */
+const SCRIPT_UNSAFE_ESCAPES = {
+    0x3c: '\\u003c',
+    0x3e: '\\u003e',
+    0x2028: '\\u2028',
+    0x2029: '\\u2029',
+};
+const SCRIPT_UNSAFE_CHARS_RE = /[<>\u2028\u2029]/g;
+/**
+ * JSON-serialize a value for safe embedding inside an inline HTML `<script>`
+ * element. For data purposes this is equivalent to `JSON.stringify(value)` — the
+ * output parses back to the identical value — but a string value can never break
+ * out of the surrounding `<script>` block.
+ *
+ * `<`, `>`, U+2028 and U+2029 never appear as JSON structural syntax (only inside
+ * string values), so escaping them on the serialized output cannot corrupt the
+ * JSON structure. The JS parser decodes each `\uXXXX` escape back to the original
+ * character, so a client that `JSON.parse`s (or evaluates) the result receives a
+ * byte-for-byte identical value.
+ *
+ * @param value - the value to serialize
+ * @returns a JSON string safe to inline in a `<script>` element
+ */
+export function serializeForScript(value) {
+    return JSON.stringify(value).replace(SCRIPT_UNSAFE_CHARS_RE, (char) => SCRIPT_UNSAFE_ESCAPES[char.charCodeAt(0)]);
+}
 /**
  * Replace a part of a source string at the indices with a different value
  *

package/package.json

@@ -4,7 +4,7 @@
     "publishConfig": {
         "access": "public"
     },
-    "version": "0.23.4",
+    "version": "0.23.6",
     "homepage": "https://developer.salesforce.com/docs/platform/lwr/overview",
     "repository": {
         "type": "git",
@@ -37,7 +37,7 @@
         "build/**/*.d.ts"
     ],
     "dependencies": {
-        "@lwrjs/diagnostics": "0.23.4",
+        "@lwrjs/diagnostics": "0.23.6",
         "es-module-lexer": "^1.5.4",
         "fast-json-stable-stringify": "^2.1.0",
         "magic-string": "^0.30.9",
@@ -50,7 +50,7 @@
         "slugify": "^1.4.5"
     },
     "devDependencies": {
-        "@lwrjs/types": "0.23.4",
+        "@lwrjs/types": "0.23.6",
         "@types/mime-types": "2.1.4",
         "@types/path-to-regexp": "^1.7.0",
         "memfs": "^4.13.0"
@@ -58,5 +58,5 @@
     "engines": {
         "node": ">=22.0.0"
     },
-    "gitHead": "dedca0fa75a00da4cb52d49e4ed507b242fe0d63"
+    "gitHead": "39e89890152606679168b0e6beb972e0b1aa47ba"
 }