fix: escape HTML characters in JSON LD

Author: andreituicu

src/steps/render.js

@@ -36,10 +36,8 @@ function createElement(name, ...attrs) {
 }
 
 function sanitizeJsonLd(jsonLd) {
-  if (jsonLd.toLowerCase().indexOf('</script>') >= 0) {
-    throw new Error('script tag not allowed');
-  }
-  return JSON.stringify(JSON.parse(jsonLd.trim()));
+  const sanitizedJsonLd = jsonLd.replaceAll('<', '&#x3c;').replaceAll('>', '&#x3e;');
+  return JSON.stringify(JSON.parse(sanitizedJsonLd.trim()));
 }
 
 /**

test/fixtures/content/page-metadata-jsonld-xss.html

@@ -8,7 +8,7 @@
     <meta name="twitter:card" content="summary_large_image">
     <meta name="twitter:title" content="Home | Helix Project Boilerplate">
     <meta name="twitter:image" content="https://helix-pages.com/default-meta-image.png?width=1200&#x26;format=pjpg&#x26;optimize=medium">
-    <script type="application/ld+json" data-error="error in json-ld: script tag not allowed"></script>
+    <script type="application/ld+json">{"foo:":"&#x3c;/script&#x3e;alert('hello, world.')"}</script>
     <link id="favicon" rel="icon" type="image/svg+xml" href="/icons/spark.svg">
     <meta name="viewport" content="width=device-width, initial-scale=1">
     <script src="/scripts.js" type="module"></script>