From cfe7c6eec28d09f9beedfe6270b55fc83e5df4e7 Mon Sep 17 00:00:00 2001 From: Pavan Kumar VH Date: Thu, 3 Sep 2026 10:43:17 +0530 Subject: [PATCH] Fix escapeString to properly escape HTML-unsafe characters The escapeString function used JSON.stringify to escape a string, which handles quotes and backslashes but doesn't escape characters that are unsafe in HTML contexts: <, >, &, and '. This is a security concern if the escaped string is used in HTML or XML contexts, as it could allow XSS attacks or HTML injection. Added explicit escaping for these characters to prevent potential security issues. --- common/src/util/string.ts | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/common/src/util/string.ts b/common/src/util/string.ts index 506de962fd..6d6466e5ec 100644 --- a/common/src/util/string.ts +++ b/common/src/util/string.ts @@ -422,5 +422,10 @@ export function suffixPrefixOverlap(source: string, next: string): string { } export const escapeString = (str: string) => { - return JSON.stringify(str).slice(1, -1) + return JSON.stringify(str) + .slice(1, -1) + .replace(//g, '\\u003e') + .replace(/&/g, '\\u0026') + .replace(/'/g, '\\u0027') }