Escape bindings, even though we generate them internally.

wailsapp · Mar 2, 2024 · 964abcc · 964abcc
1 parent 5d22da4
commit 964abcc
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/v2/pkg/assetserver/assetserver.go b/v2/pkg/assetserver/assetserver.go
@@ -8,6 +8,7 @@ import (
 	"strings"
 
 	"golang.org/x/net/html"
+	"html/template"
 
 	"github.com/wailsapp/wails/v2/pkg/options"
 	"github.com/wailsapp/wails/v2/pkg/options/assetserver"
@@ -67,9 +68,11 @@ func NewAssetServer(bindingsJSON string, options assetserver.Options, servingFro
 }
 
 func NewAssetServerWithHandler(handler http.Handler, bindingsJSON string, servingFromDisk bool, logger Logger, runtime RuntimeAssets) (*AssetServer, error) {
+
 	var buffer bytes.Buffer
 	if bindingsJSON != "" {
-		buffer.WriteString(`window.wailsbindings='` + bindingsJSON + `';` + "\n")
+		escapedBindingsJSON := template.JSEscapeString(bindingsJSON)
+		buffer.WriteString(`window.wailsbindings='` + escapedBindingsJSON + `';` + "\n")
 	}
 	buffer.Write(runtime.RuntimeDesktopJS())