From 22a4fae0c2ffe51330484892f13376a46cf9c89c Mon Sep 17 00:00:00 2001
From: 0xDEADCADE <69792955+0xDEADCADE@users.noreply.github.com>
Date: Thu, 8 Jun 2023 15:15:03 +0000
Subject: [PATCH] Fix isoData can contain user generated content (#1114)

* Fix isoData can contain user generated content

* Fix formatting
---
 src/server/index.tsx | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/src/server/index.tsx b/src/server/index.tsx
index e220cd6..f96901b 100644
--- a/src/server/index.tsx
+++ b/src/server/index.tsx
@@ -25,6 +25,7 @@ import {
   favIconUrl,
   initializeSite,
   isAuthPath,
+  md,
 } from "../shared/utils";
 
 const server = express();
@@ -347,7 +348,9 @@ async function createSsrHtml(root: string, isoData: IsoDataOptionalSite) {
   <!DOCTYPE html>
   <html ${helmet.htmlAttributes.toString()} lang="en">
   <head>
-  <script>window.isoData = ${JSON.stringify(isoData)}</script>
+  <script>window.isoData = ${md.utils.escapeHtml(
+    JSON.stringify(isoData)
+  )}</script>
   <script>window.lemmyConfig = ${serialize(config)}</script>
 
   <!-- A remote debugging utility for mobile -->
-- 
2.44.1

