@scalar/client-side-rendering 0.4.4 → 0.4.5

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @scalar/client-side-rendering
 
+## 0.4.5
+
+### Patch Changes
+
+- [#10344](https://github.com/scalar/scalar/pull/10344): Share JSON and property-name escaping for inline scripts between client-side and server-side rendering.
+- [#10344](https://github.com/scalar/scalar/pull/10344): Escape configuration data embedded in inline scripts to prevent HTML script injection.
+
 ## 0.4.4
 
 ## 0.4.3

package/dist/html-rendering.d.ts

@@ -61,6 +61,9 @@ export declare function renderApiReference(options: {
  * That is what lets callbacks survive being written into an inline `<script>` tag, or across any other
  * boundary that would otherwise JSON-serialize the configuration and silently drop functions.
  *
+ * Function values are trusted executable code, not untrusted configuration data. Their source
+ * must be safe to embed in an inline script.
+ *
  * Note: functions must be arrow functions or `function` expressions. Object method shorthand
  * (`onBeforeRequest(request) {}`) does not serialize to a valid standalone expression.
  */

package/dist/html-rendering.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"html-rendering.d.ts","sourceRoot":"","sources":["../src/html-rendering.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAA;AAE3G,YAAY,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,CAAA;AAExE;;;;;GAKG;AACH,eAAO,MAAM,WAAW,uDAAuD,CAAA;AAE/E;;;;;GAKG;AACH,eAAO,MAAM,eAAe,8DAA8D,CAAA;AAoE1F;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE;IACP,uCAAuC;IACvC,MAAM,EAAE,4BAA4B,CAAA;IACpC,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,+DAA+D;IAC/D,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ;;;;;;;;;;OAUG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CAC1B,EACD,WAAW,SAAK,GACf,MAAM,CAiCR;AASD;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CA+BlF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,aAAa,CAC3B,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACtC,GAAG,CAAC,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,GACxB,MAAM,CA8BR;AAED;;GAEG;AACH,eAAO,MAAM,gBAAgB,GAC3B,oBAAoB,OAAO,CAAC,0BAA0B,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAChF,MAAM,CAAC,MAAM,EAAE,OAAO,CAcxB,CAAA"}
+{"version":3,"file":"html-rendering.d.ts","sourceRoot":"","sources":["../src/html-rendering.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAA;AAE3G,YAAY,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,CAAA;AAExE;;;;;GAKG;AACH,eAAO,MAAM,WAAW,uDAAuD,CAAA;AAE/E;;;;;GAKG;AACH,eAAO,MAAM,eAAe,8DAA8D,CAAA;AAoE1F;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE;IACP,uCAAuC;IACvC,MAAM,EAAE,4BAA4B,CAAA;IACpC,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,+DAA+D;IAC/D,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ;;;;;;;;;;OAUG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CAC1B,EACD,WAAW,SAAK,GACf,MAAM,CAiCR;AASD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CA+BlF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,aAAa,CAC3B,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACtC,GAAG,CAAC,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,GACxB,MAAM,CA8BR;AAED;;GAEG;AACH,eAAO,MAAM,gBAAgB,GAC3B,oBAAoB,OAAO,CAAC,0BAA0B,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAChF,MAAM,CAAC,MAAM,EAAE,OAAO,CAcxB,CAAA"}

package/dist/html-rendering.js

@@ -1,3 +1,5 @@
+import { escapeJsonForInlineScript } from '@scalar/helpers/json/escape-json-for-inline-script';
+import { serializePropertyKey } from '@scalar/helpers/json/serialize-property-key';
 /**
  * Default CDN URL for the @scalar/api-reference UMD standalone bundle.
  *
@@ -111,7 +113,7 @@ export function renderApiReference(options, customTheme = '') {
  * Helper function to serialize arrays that may contain functions
  */
 const serializeArrayWithFunctions = (arr) => {
-    return `[${arr.map((item) => (typeof item === 'function' ? item.toString() : JSON.stringify(item))).join(', ')}]`;
+    return `[${arr.map((item) => (typeof item === 'function' ? item.toString() : escapeJsonForInlineScript(JSON.stringify(item) ?? 'undefined'))).join(', ')}]`;
 };
 /**
  * Serialize a configuration object to a JavaScript object literal string.
@@ -121,6 +123,9 @@ const serializeArrayWithFunctions = (arr) => {
  * That is what lets callbacks survive being written into an inline `<script>` tag, or across any other
  * boundary that would otherwise JSON-serialize the configuration and silently drop functions.
  *
+ * Function values are trusted executable code, not untrusted configuration data. Their source
+ * must be safe to embed in an inline script.
+ *
  * Note: functions must be arrow functions or `function` expressions. Object method shorthand
  * (`onBeforeRequest(request) {}`) does not serialize to a valid standalone expression.
  */
@@ -129,15 +134,15 @@ export function serializeConfigToJs(configuration) {
     const functionProps = [];
     for (const [key, value] of Object.entries(configuration)) {
         if (typeof value === 'function') {
-            functionProps.push(`"${key}": ${value.toString()}`);
+            functionProps.push(`${serializePropertyKey(key)}: ${value.toString()}`);
             delete restConfig[key];
         }
         else if (Array.isArray(value) && value.some((item) => typeof item === 'function')) {
-            functionProps.push(`"${key}": ${serializeArrayWithFunctions(value)}`);
+            functionProps.push(`${serializePropertyKey(key)}: ${serializeArrayWithFunctions(value)}`);
             delete restConfig[key];
         }
     }
-    const jsonString = JSON.stringify(restConfig, null, 2);
+    const jsonString = escapeJsonForInlineScript(JSON.stringify(restConfig, null, 2));
     const indentedJsonString = jsonString
         .split('\n')
         .map((line, index) => (index === 0 ? line : `      ${line}`))

package/package.json

@@ -11,7 +11,7 @@
     "directory": "packages/client-side-rendering"
   },
   "keywords": [],
-  "version": "0.4.4",
+  "version": "0.4.5",
   "engines": {
     "node": ">=22"
   },
@@ -29,8 +29,9 @@
     "CHANGELOG.md"
   ],
   "dependencies": {
-    "@scalar/schemas": "0.12.0",
-    "@scalar/types": "0.22.0",
+    "@scalar/helpers": "0.15.0",
+    "@scalar/schemas": "0.12.1",
+    "@scalar/types": "0.22.1",
     "@scalar/validation": "0.6.5"
   },
   "devDependencies": {