romshark / datapages / 36180018610

44%

Build Type

push

github

Committed by romshark

Commit Message

fix: Escape SSE.Prefetch URLs

datastar-go writes prefetch URLs raw inside JSON in a script element.
An attacker-controlled quote and closing tag can escape both contexts
and run JavaScript in the page's origin (XSS).

The custom encoder avoids encoding/json's extra allocs on common path.
44 -> 20 allocs and 1,108 ns -> 377 ns per call for three URLs.

Coverage Stats

41 of 41 new or added lines in 1 file covered. (100.0%)

1 existing line in 1 file now uncovered.

14170 of 35694 relevant lines covered (39.7%)

34.33 hits per line