From 915a9b6984d1ff0a1651cb36a8415377dde52a68 Mon Sep 17 00:00:00 2001 From: Marcelo Ceccon <32395187+marceloceccon@users.noreply.github.com> Date: Mon, 26 Oct 2026 16:07:46 +0000 Subject: [PATCH] security: bump vulnerable deps via pnpm overrides; escape inline theme script literal --- components/ui/theme-script.ts | 20 +- package.json | 17 +- pnpm-lock.yaml | 662 +++++++++++++------------- tests/ui-theme-tooltip-shell.test.tsx | 11 +- 4 files changed, 365 insertions(+), 345 deletions(-) diff --git a/components/ui/theme-script.ts b/components/ui/theme-script.ts index 6d0d49d..0146615 100644 --- a/components/ui/theme-script.ts +++ b/components/ui/theme-script.ts @@ -5,11 +5,29 @@ export const THEME_STORAGE_KEY = "rt.theme"; +const UNSAFE_SCRIPT_CHARS: Record = { + "<": "\\u003C", + ">": "\\u003E", + "/": "\\u002F", + "\u2028": "\\u2028", + "\u2029": "\\u2029", +}; + +/** + * Serialize a value as a JavaScript literal that is safe to embed inside an + * inline `\u2028\u2029"; + const literal = toInlineScriptLiteral(value); + expect(literal).not.toMatch(/[<>/\u2028\u2029]/); + expect(new Function(`return ${literal};`)()).toBe(value); + }); +}); + describe("ThemeToggle", () => { it("cycles the theme and updates its label", () => { render();