Docs: scrub html in ld+json script
#79627
Conversation
ijjk
added
created-by: Next.js DevEx team
|
|
|
||
| The following snippet uses `JSON.stringify`, which does not sanitize malicious strings used in XSS injection. To prevent this type of vulnerability, you can scrub `HTML` tags from the `JSON-LD` payload, for example, by replacing the character, `<`, with its unicode equivalent, `\u003c`. | ||
|
|
||
| Review your organization's recommended approach to sanitize potentially dangerous strings, or use community maintained alternatives for `JSON.stringify` such as, [serialize-javascript](https://www.npmjs.com/package/serialize-javascript). |
There was a problem hiding this comment.
this could also recommend https://github.com/google/react-schemaorg, which does all the necessary escaping according to spec.
There was a problem hiding this comment.
Nice, I didn't know about that package, and it seems to play well with schema-dts too.
There was a problem hiding this comment.
it seems to play well with schema-dts too
i think both packages are maintained by the same team.
Closes: https://linear.app/vercel/issue/DOC-4708/json-ld-security-w-jsonstringify
Fixes: #79593