fix: escape single fetch transfer (remix-run#9084)

vercel · Mar 19, 2024 · 283df54 · 283df54
1 parent ce5cfe0
commit 283df54
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 2 deletions.
diff --git a/.changeset/shy-buttons-buy.md b/.changeset/shy-buttons-buy.md
@@ -0,0 +1,6 @@
+---
+"remix": patch
+"@remix-run/react": patch
+---
+
+fix: escape single fetch transfer
diff --git a/packages/remix-react/single-fetch.tsx b/packages/remix-react/single-fetch.tsx
@@ -20,6 +20,7 @@ import { decode } from "turbo-stream";
 
 import { createRequestInit } from "./data";
 import type { AssetsManifest, EntryContext } from "./entry";
+import { escapeHtml } from "./markup";
 import type { RouteModules } from "./routeModules";
 import invariant from "./invariant";
 
@@ -74,8 +75,8 @@ export function StreamTransfer({
   let scriptTag = value ? (
     <script
       dangerouslySetInnerHTML={{
-        __html: `window.__remixContext.streamController.enqueue(${JSON.stringify(
-          value
+        __html: `window.__remixContext.streamController.enqueue(${escapeHtml(
+          JSON.stringify(value)
         )});`,
       }}
     />