wildlyinaccurate / second Goto Github PK

To replicate:

1. Use second with a JSON endpoint which contains an attribute with a <script></script>
2. dehydration of the component results in a </script> being output as part of the serialised JSON in the HTML, which then prematurely ends the script block that the data is inside.

Suggestion:
See: https://github.com/wildlyinaccurate/second/blob/master/packages/second-dehydrator/src/dehydrator.js#L6

It appears that JSON.stringify() does not escape forward slashes (/), so the suggestion is to add .replace(/\//g, '\\/'); to the end of this line.