Skip to content

fix: safely serialize webview initialization data - #699

Merged
agrawal-d merged 2 commits into
agrawal-d:mainfrom
Yan233th:fix/webview-inline-settings-escaping
Aug 3, 2026
Merged

fix: safely serialize webview initialization data#699
agrawal-d merged 2 commits into
agrawal-d:mainfrom
Yan233th:fix/webview-inline-settings-escaping

Conversation

@Yan233th

@Yan233th Yan233th commented Aug 2, 2026

Copy link
Copy Markdown
Contributor

When config paths contain \u (e.g. \uv) on Windows, a SyntaxError will be thrown because webview script will tries to parse \u as a unicode escape.
So I fixed it by using JSON.stringify instead of injecting raw settings strings into scripts.
Also added tests for Windows path escaping.

image

Acknowledge

  • I have manually written, without the help of an LLM, the pull request description clearly and succinctly.
  • I have carefully reviewed the code myself, and ensured the changes are correct and well-tested (including manual testing).
  • I have not made any unintentional changes (package.json changes, lockfile changes, .vscode changes, etc.).
  • Any new features and settings introduced have been documented in the docs markdown(s) with screenshot(s) where useful, manually, without the use of AI to write the docs.

Yan233th added 2 commits July 29, 2026 23:20
Encode settings and other dynamic values before embedding them in the webview's inline script, preserving Windows paths and preventing script termination.
Add regression coverage for Windows command paths and values that could alter or terminate an inline script.

@agrawal-d agrawal-d left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks

@agrawal-d
agrawal-d merged commit ceb965b into agrawal-d:main Aug 3, 2026
10 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants