Unescaped JSON in a <script> tagUnescaped JSON in a <script> tag

Why it matters

JSON.stringify does not escape </script>: any string in the data containing it ends the script element and the rest runs as HTML (stored XSS through JSON-LD).

Fix

Escape <: JSON.stringify(data).replace(/</g, "\\u003c").

Credit

• 

  From the Next.js team

  The JSON-LD guide shows sanitizing JSON.stringify output by replacing < with \u003c.

• O

  From OWASP

  Output encoding for the HTML context is the core defence against cross-site scripting.

References

• How to implement JSON-LD in your Next.js applicationNext.js
• Cross Site Scripting Prevention - OWASP Cheat Sheet SeriesOWASP Cheat Sheet Series
• Cross Site Scripting (XSS)OWASP

See it