Web Security · Middle · Question 12 of 75

Server-rendered state is embedded like this: `<script>window.STATE = ${JSON.stringify(state)}</script>`. What's the problem?

✓Correct answer: A string containing </script> closes the tag early, allowing XSS; < must be escaped (for example as \u003c)
2JSON.stringify removes all strings
3Nothing, JSON is always safe inside a script tag

Explanation

The HTML parser sees </script> before JavaScript runs. Frameworks and serializers that are made for this escape <, > and /.

Further reading

Test yourself

Take the Web Security · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.