From 867d67422ebc5b8e6558721972085a1fc2d1cb50 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
<161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Wed, 22 Jul 2026 15:02:34 +0000
Subject: [PATCH 1/2] =?UTF-8?q?=F0=9F=94=92=20fix:=20mitigate=20XSS=20via?=
=?UTF-8?q?=20set:html=20with=20JSON.stringify=20in=20Astro=20scripts?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Creates a `safeJsonStringify` utility that replaces HTML control characters (`<`, `>`, `&`) with unicode escapes, and refactors all instances of `` to use this utility.
Co-authored-by: lsb11 <269203137+lsb11@users.noreply.github.com>
---
fix_safe_json.py | 6 ++++++
src/components/Evidence.astro | 3 ++-
src/layouts/Base.astro | 3 ++-
src/pages/analyzify-alternative.astro | 3 ++-
src/pages/app-audit.astro | 3 ++-
src/pages/best-ai-tools-shopify.astro | 11 ++++++-----
src/pages/best-free-shopify-apps-2026.astro | 5 +++--
...avoid-limits-and-scale-your-automations.astro | 3 ++-
...fy-agentic-storefronts-setup-guide-2026.astro | 3 ++-
...rver-side-tracking-complete-setup-guide.astro | 3 ++-
src/pages/capi-shield.astro | 5 +++--
src/pages/elevar-alternative.astro | 3 ++-
src/pages/gorgias-shopify-guide.astro | 3 ++-
src/pages/index.astro | 3 ++-
src/pages/klaviyo-vs-systeme-io.astro | 3 ++-
src/pages/make-com-shopify.astro | 3 ++-
src/pages/northbeam-alternative.astro | 3 ++-
src/pages/privacy.astro | 3 ++-
src/pages/refund-policy.astro | 3 ++-
src/pages/replace-klaviyo-free.astro | 5 +++--
src/pages/shopify-app-pricing-index.astro | 5 +++--
src/pages/shopify-automation-guides.astro | 11 ++++++-----
src/pages/shopify-automation-scanner.astro | 5 +++--
.../shopify-google-ads-conversion-tracking.astro | 5 +++--
.../shopify-ios-attribution-gap-benchmark.astro | 5 +++--
src/pages/shopify-tracking-tools-pricing.astro | 5 +++--
src/pages/sitemap-page.astro | 3 ++-
src/pages/stack.astro | 13 +++++++------
src/pages/stocky-alternative.astro | 3 ++-
src/pages/stocky-migration-checklist.astro | 3 ++-
src/pages/stocky-swap.astro | 3 ++-
src/pages/terms.astro | 3 ++-
src/pages/tidio-shopify-guide.astro | 3 ++-
src/pages/tiktok-events-api-shopify.astro | 5 +++--
src/pages/triple-whale-alternative.astro | 3 ++-
.../ultimate-shopify-automation-guide.astro | 5 +++--
src/utils/safeJson.ts | 16 ++++++++++++++++
37 files changed, 115 insertions(+), 58 deletions(-)
create mode 100644 fix_safe_json.py
create mode 100644 src/utils/safeJson.ts
diff --git a/fix_safe_json.py b/fix_safe_json.py
new file mode 100644
index 0000000..490708e
--- /dev/null
+++ b/fix_safe_json.py
@@ -0,0 +1,6 @@
+with open("src/utils/safeJson.ts", "r") as f:
+ content = f.read()
+content = content.replace("return jsonString", "return jsonString?")
+content = content.replace(".replace(/&/g, '\\\\u0026');", ".replace(/&/g, '\\\\u0026') ?? '';")
+with open("src/utils/safeJson.ts", "w") as f:
+ f.write(content)
diff --git a/src/components/Evidence.astro b/src/components/Evidence.astro
index a979f8c..b084b67 100644
--- a/src/components/Evidence.astro
+++ b/src/components/Evidence.astro
@@ -1,4 +1,5 @@
---
+import { safeJsonStringify } from '../utils/safeJson';
/**
* Evidence.astro — proof block for real screenshots / recordings.
*
@@ -96,7 +97,7 @@ const schema = videoSrc
-
+