romshark / datapages / 36180018610

push

github

fix: Escape SSE.Prefetch URLs

datastar-go writes prefetch URLs raw inside JSON in a script element.
An attacker-controlled quote and closing tag can escape both contexts
and run JavaScript in the page's origin (XSS).

The custom encoder avoids encoding/json's extra allocs on common path.
44 -> 20 allocs and 1,108 ns -> 377 ns per call for three URLs.

41 of 41 new or added lines in 1 file covered. (100.0%)

14170 of 35694 relevant lines covered (39.7%)

34.33 hits per line