diff options
Diffstat (limited to 'src/util/js-template.ts')
| -rw-r--r-- | src/util/js-template.ts | 17 |
1 files changed, 1 insertions, 16 deletions
diff --git a/src/util/js-template.ts b/src/util/js-template.ts index 392dbc0..75e0217 100644 --- a/src/util/js-template.ts +++ b/src/util/js-template.ts @@ -1,19 +1,4 @@ -/** - * Build a JavaScript source string with safely-interpolated values. - * Every interpolated value is JSON.stringify'd, so strings, numbers, - * objects, and special characters all become valid JS literals. - * - * This is the ONLY supported way to interpolate untrusted values into - * evaluation source — never use raw template literals for JS that - * crosses the CDP boundary. The static parts of the template (the - * `strings` array) must remain hard-coded; only the `${...}` slots - * are sanitized. - * - * Values must be JSON-serializable: BigInt and Symbol throw at runtime; - * functions and undefined serialize to `undefined`/omitted, which yields - * a ReferenceError when evaluated. Pass strings, numbers, booleans, - * plain objects, or arrays. - */ +// The ONLY supported way to interpolate untrusted values into evaluation source — never use raw template literals for JS crossing the CDP boundary. export const safeJs = ( strings: TemplateStringsArray, ...values: ReadonlyArray<unknown> |