Fix isoData can contain user generated content (#1114)

* Fix isoData can contain user generated content * Fix formatting
LemmyNet · Jun 8, 2023 · 32f5120 · 32f5120
1 parent c5006cc
commit 32f5120
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/src/server/index.tsx b/src/server/index.tsx
@@ -17,7 +17,7 @@ import {
   IsoData,
 } from "../shared/interfaces";
 import { routes } from "../shared/routes";
-import { initializeSite } from "../shared/utils";
+import { initializeSite, md } from "../shared/utils";
 
 const server = express();
 const [hostname, port] = process.env["LEMMY_UI_HOST"]
@@ -180,7 +180,9 @@ server.get("/*", async (req, res) => {
            <!DOCTYPE html>
            <html ${helmet.htmlAttributes.toString()} lang="en">
            <head>
-           <script>window.isoData = ${JSON.stringify(isoData)}</script>
+           <script>window.isoData = ${md.utils.escapeHtml(
+             JSON.stringify(isoData)
+           )}</script>
            <script>window.lemmyConfig = ${serialize(config)}</script>
 
            <!-- A remote debugging utility for mobile -->