From 964abcc6bd1edffd5a9ed447d7a5806492178aee Mon Sep 17 00:00:00 2001 From: Lea Anthony Date: Sat, 2 Mar 2024 16:42:20 +1100 Subject: [PATCH] Escape bindings, even though we generate them internally. --- v2/pkg/assetserver/assetserver.go | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/v2/pkg/assetserver/assetserver.go b/v2/pkg/assetserver/assetserver.go index 54fe5d06..59665c09 100644 --- a/v2/pkg/assetserver/assetserver.go +++ b/v2/pkg/assetserver/assetserver.go @@ -8,6 +8,7 @@ import ( "strings" "golang.org/x/net/html" + "html/template" "github.com/wailsapp/wails/v2/pkg/options" "github.com/wailsapp/wails/v2/pkg/options/assetserver" @@ -67,9 +68,11 @@ func NewAssetServer(bindingsJSON string, options assetserver.Options, servingFro } func NewAssetServerWithHandler(handler http.Handler, bindingsJSON string, servingFromDisk bool, logger Logger, runtime RuntimeAssets) (*AssetServer, error) { + var buffer bytes.Buffer if bindingsJSON != "" { - buffer.WriteString(`window.wailsbindings='` + bindingsJSON + `';` + "\n") + escapedBindingsJSON := template.JSEscapeString(bindingsJSON) + buffer.WriteString(`window.wailsbindings='` + escapedBindingsJSON + `';` + "\n") } buffer.Write(runtime.RuntimeDesktopJS())