fix: further escape JS expressions

packages/vike-react-zustand/src/getOrCreateStore.ts

@@ -41,10 +41,11 @@ function getOrCreateStore<T>({
       const serverState = store.getInitialState()
       const transferableState = sanitizeForSerialization(serverState)
       assert(stream)
-      // No need to escape the injected HTML — see https://github.com/vikejs/vike/blob/36201ddad5f5b527b244b24d548014ec86c204e4/packages/vike/src/server/runtime/renderPageServer/csp.ts#L45
+      // No need to escape the injected nonce attribute — see https://github.com/vikejs/vike/blob/36201ddad5f5b527b244b24d548014ec86c204e4/packages/vike/src/server/runtime/renderPageServer/csp.ts#L45
       const nonceAttr = pageContext.cspNonce ? ` nonce="${pageContext.cspNonce}"` : ''
       stream.injectToStream(
-        `<script${nonceAttr}>if(!globalThis._vikeReactZustandState)globalThis._vikeReactZustandState={};globalThis._vikeReactZustandState['${key}']='${stringify(transferableState, { htmlScriptSafe: true })}'</script>`,
+        `<script type="application/json"${nonceAttr}>${stringify(transferableState, { htmlScriptSafe: true })}</script>` +
+          `<script${nonceAttr}>if(!globalThis._vikeReactZustandState)globalThis._vikeReactZustandState={};globalThis._vikeReactZustandState['${key}']=document.currentScript.previousElementSibling.textContent</script>`,
       )
       pageContext._vikeReactZustandStoresServer[key] = store
       return store

packages/vike-react/src/hooks/useConfig/useConfig-server.ts

@@ -8,6 +8,7 @@ import { useStreamOptional } from 'react-streaming'
 import { objectKeys } from '../../utils/objectKeys.js'
 import { includes } from '../../utils/includes.js'
 import { assert } from '../../utils/assert.js'
+import { escapeJavaScriptExpression } from '../../utils/escapeJavaScriptExpression.js'
 import { configsCumulative } from './configsCumulative.js'
 import { configsClientSide } from './configsClientSide.js'
 
@@ -61,9 +62,10 @@ type Stream = NonNullable<ReturnType<typeof useStreamOptional>>
 function apply(config: ConfigViaHook, stream: Stream, pageContext: PageContextServer) {
   const { title } = config
   if (title) {
-    // No need to escape the injected HTML — see https://github.com/vikejs/vike/blob/36201ddad5f5b527b244b24d548014ec86c204e4/packages/vike/src/server/runtime/renderPageServer/csp.ts#L45
+    // No need to escape the injected nonce attribute — see https://github.com/vikejs/vike/blob/36201ddad5f5b527b244b24d548014ec86c204e4/packages/vike/src/server/runtime/renderPageServer/csp.ts#L45
     const nonceAttr = pageContext.cspNonce ? ` nonce="${pageContext.cspNonce}"` : ''
-    const htmlSnippet = `<script${nonceAttr}>document.title = ${JSON.stringify(title)}</script>`
+    const titleJs = escapeJavaScriptExpression(JSON.stringify(title))
+    const htmlSnippet = `<script${nonceAttr}>document.title = ${titleJs}</script>`
     stream.injectToStream(htmlSnippet)
   }
 }

packages/vike-react/src/utils/escapeJavaScriptExpression.ts

@@ -0,0 +1,15 @@
+/**
+ * Escapes a JavaScript expression (e.g. the output of `JSON.stringify()`) so that it can be safely embedded inside an inline `<script>`.
+ *
+ * https://github.com/vikejs/vike/issues/3463
+ */
+export function escapeJavaScriptExpression(js: string): string {
+  return (
+    js
+      // `<` is escaped so that the HTML parser never encounters `</script>` nor `<!--` inside the `<script>` — the JavaScript parser decodes `\u003c` back to `<`. (The input must be a JavaScript expression whose `<` only ever occurs inside string literals, such as `JSON.stringify()` output.)
+      .replace(/</g, '\\u003c')
+      // U+2028/U+2029 are escaped because a raw U+2028/U+2029 inside a JavaScript string literal is a syntax error in pre-ES2019 browsers.
+      .replace(/\u2028/g, '\\u2028')
+      .replace(/\u2029/g, '\\u2029')
+  )
+}