javascript / expert
Snippet
Preventing Script Context Injection in Server-Side State Serialization
When passing server-side rendered state to client hydration scripts, plain JSON.stringify is vulnerable to XSS if payload strings contain script termination sequences or unicode line terminators. Escaping HTML tokens ensures safe inline script embedding.
snippet.js
javascript
1
2
3
4
5
6
7
8
9
10
11
export function safeSerializeState(data) {try {const json = JSON.stringify(data);return json.replace(/</g, '\\u003c').replace(/>/g, '\\u003e').replace(/\u2028/g, '\\u2028').replace(/\u2029/g, '\\u2029');} catch (err) {throw new Error(`Serialization failed due to cyclic or invalid payload: ${err.message}`);}}
svelte
Breakdown
1
export function safeSerializeState(data) {
Exports a utility function for sanitizing serialized SSR state payloads.
2
const json = JSON.stringify(data);
Converts the state object into a standard JSON string representation.
3
return json.replace(/</g, '\\u003c')
Replaces opening angle brackets with unicode escape sequences to prevent tag breakout.
4
.replace(/\u2028/g, '\\u2028')
Escapes Unicode line separators that break JS string parsing in script blocks.
5
throw new Error(...)
Catches serialization errors such as circular references and wraps them cleanly.