fix: ensure json strings are properly encoded (#520)

harlan-zw · github-advanced-security[bot] · web-flow · commit f65642f9427f · 2025-03-13T18:30:44.000+11:00
* Potential fix for code scanning alert no. 2: Incomplete string escaping or encoding

Co-authored-by: Copilot Autofix powered by AI &lt;62310815+github-advanced-security[bot]@users.noreply.github.com&gt;

* chore: bump tests

* chore: bump snapshots

---------

Co-authored-by: Copilot Autofix powered by AI &lt;62310815+github-advanced-security[bot]@users.noreply.github.com&gt;
diff --git a/packages/unhead/src/utils/templateParams.ts b/packages/unhead/src/utils/templateParams.ts
@@ -19,6 +19,7 @@ function sub(p: TemplateParams, token: string, isJson = false) {
   if (val !== undefined) {
     return isJson
       ? (val || '')
+          .replace(/\\/g, '\\\\')
           .replace(/</g, '\\u003C')
           .replace(/"/g, '\\"')
       : val || ''
diff --git a/packages/unhead/test/unit/client/templateParams.test.ts b/packages/unhead/test/unit/client/templateParams.test.ts
@@ -132,7 +132,7 @@ describe('templateParams', () => {
     expect(await useDelayedSerializedDom()).toMatchInlineSnapshot(`
       "<!DOCTYPE html><html><head>
 
-      <title>Home &amp; //&lt;"With Encoding"&gt;\\</title><script type="application/json">{"title":"Home & //\\u003C\\"With Encoding\\">\\"}</script></head>
+      <title>Home &amp; //&lt;"With Encoding"&gt;\\</title><script type="application/json">{"title":"Home & //\\u003C\\"With Encoding\\">\\\\"}</script></head>
       <body>
 
       <div>
diff --git a/packages/unhead/test/unit/server/templateParams.test.ts b/packages/unhead/test/unit/server/templateParams.test.ts
@@ -116,7 +116,7 @@ describe('ssr templateParams', () => {
 
     expect(headTags).toMatchInlineSnapshot(`
       "<title>Home &amp; &#x2F;&#x2F;&lt;&quot;With Encoding&quot;&gt;\\</title>
-      <script type="application/json">{"title":"Home & //\\u003C\\"With Encoding\\">\\"}</script>"
+      <script type="application/json">{"title":"Home & //\\u003C\\"With Encoding\\">\\\\"}</script>"
     `)
   })
 
