fix: safely serialize webview initialization data

src/tests/utilsPure.test.ts

@@ -1,5 +1,9 @@
 globalThis.logger = { ...console };
-import { words_in_text, toPascalCase } from '../utilsPure';
+import {
+    serializeForInlineScript,
+    words_in_text,
+    toPascalCase,
+} from '../utilsPure';
 
 describe('problem name parser', () => {
     test('mix of latin, non latin and numbers', () => {
@@ -105,3 +109,25 @@ describe('toPascalCase', () => {
         expect(toPascalCase('Binary_Search_Tree')).toBe('BinarySearchTree');
     });
 });
+
+describe('serializeForInlineScript', () => {
+    test('preserves Windows paths without creating escape sequences', () => {
+        const pythonCommand =
+            'C:\\Users\\ExampleUser\\AppData\\Roaming\\uv\\python\\cpython-xxx\\python.exe';
+        const serialized = serializeForInlineScript(pythonCommand);
+
+        expect(serialized).toContain('C:\\\\Users\\\\ExampleUser');
+        expect(serialized).toContain(
+            'Roaming\\\\uv\\\\python\\\\cpython-xxx\\\\python.exe',
+        );
+        expect(JSON.parse(serialized)).toBe(pythonCommand);
+    });
+
+    test('escapes characters that can terminate or alter an inline script', () => {
+        const value = "'</script><script>alert(1)</script>\n\u2028\u2029&";
+        const serialized = serializeForInlineScript({ value });
+
+        expect(serialized).not.toMatch(/[<>&\u2028\u2029]/u);
+        expect(JSON.parse(serialized)).toEqual({ value });
+    });
+});

src/utilsPure.ts

@@ -48,3 +48,18 @@ export const toAsciiFilename = (input: string): string => {
         })
         .join('');
 };
+
+/** Serializes a value for use as an expression inside an HTML script element. */
+export const serializeForInlineScript = (value: unknown): string => {
+    const serialized = JSON.stringify(value);
+    if (serialized === undefined) {
+        throw new TypeError('Cannot serialize value for an inline script');
+    }
+
+    return serialized
+        .replace(/&/g, '\\u0026')
+        .replace(/</g, '\\u003c')
+        .replace(/>/g, '\\u003e')
+        .replace(/\u2028/g, '\\u2028')
+        .replace(/\u2029/g, '\\u2029');
+};

src/webview/JudgeView.ts

@@ -19,6 +19,7 @@ import {
 } from '../preferences';
 import { setOnlineJudgeEnv, onlineJudgeEnv } from '../compiler';
 import { translations } from './translations';
+import { serializeForInlineScript } from '../utilsPure';
 
 class JudgeViewProvider implements vscode.WebviewViewProvider {
     public static readonly viewType = 'cph.judgeView';
@@ -329,6 +330,17 @@ class JudgeViewProvider implements vscode.WebviewViewProvider {
             pythonCommand = 'python';
         }
 
+        const initialState = serializeForInlineScript({
+            meowAudioUri: meowAudioUri.toString(),
+            remoteMessage,
+            generatedJsonUri: generatedJsonUri.toString(),
+            remoteServerAddress,
+            showLiveUserCount,
+            showOutputDifference: !getHideOutputDifferencePref(),
+            translations: translation,
+            pythonCommand,
+        });
+
         const html = `
             <!DOCTYPE html>
             <html>
@@ -349,14 +361,7 @@ class JudgeViewProvider implements vscode.WebviewViewProvider {
                         // Since the react script takes time to load, the problem is sent to the webview before it has even loaded.
                         // So, for the initial request, ask for it again.
                         window.vscodeApi = acquireVsCodeApi();
-                        window.meowAudioUri = '${meowAudioUri}';
-                        window.remoteMessage = '${remoteMessage}';
-                        window.generatedJsonUri = '${generatedJsonUri}';
-                        window.remoteServerAddress = '${remoteServerAddress}';
-                        window.showLiveUserCount = ${showLiveUserCount};
-                        window.showOutputDifference = ${!getHideOutputDifferencePref()};
-                        window.translations = ${JSON.stringify(translation)};
-                        window.pythonCommand = '${pythonCommand}';
+                        Object.assign(window, ${initialState});
 
                         document.addEventListener(
                             'DOMContentLoaded',