Browser & Web Performance · Senior · Question 53 of 75

What is the danger of injecting server data into an inline script like this?

<script>
  window.__STATE__ = ${JSON.stringify(state)};
</script>

✓Correct answer: A string containing </script> closes the tag early and lets the rest run as attacker-controlled HTML
2JSON.stringify can't serialize nested objects
3Inline scripts can't define globals

Explanation

Escape < as \u003c when embedding JSON in HTML, or put data in a type="application/json" script and parse it.

Further reading

Test yourself

Take the Browser & Web Performance · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.