src/util/js-template.ts (view raw)
1 2 3 4 5 6 7 8 9 10 11 12 |
// The ONLY supported way to interpolate untrusted values into evaluation source — never use raw template literals for JS crossing the CDP boundary.
export const safeJs = (
strings: TemplateStringsArray,
...values: ReadonlyArray<unknown>
): string => {
let out = strings[0] ?? "";
for (let i = 0; i < values.length; i++) {
out += JSON.stringify(values[i]);
out += strings[i + 1] ?? "";
}
return out;
};
|