packages/vite-plugin/src/virtuals/hardenJsonStringLiteralForEmbeddedScript.ts (1)

9-16: Optional: add a contract guard to catch accidental non-JSON-literal inputs.

A tiny precondition can prevent misuse in future call sites.

Suggested defensive check

 export function hardenJsonStringLiteralForEmbeddedScript(jsonStringified: string): string {
+  if (!(jsonStringified.startsWith('"') && jsonStringified.endsWith('"'))) {
+    throw new Error('Expected a JSON.stringify(...) string literal input')
+  }
   return jsonStringified
     .replace(/</g, '\\u003C')
     .replace(/>/g, '\\u003E')
     .replace(/\//g, '\\u002F')
     .replace(/\u2028/g, '\\u2028')
     .replace(/\u2029/g, '\\u2029')
 }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@packages/vite-plugin/src/virtuals/hardenJsonStringLiteralForEmbeddedScript.ts`
around lines 9 - 16, Add a defensive contract guard to
hardenJsonStringLiteralForEmbeddedScript: verify the input is a string (typeof
jsonStringified === 'string') and sanity-check that it looks like a JSON literal
(e.g. starts with '"', '{', '[' or matches /^-?\d|^(true|false|null)/); if the
check fails throw a clear TypeError mentioning
hardenJsonStringLiteralForEmbeddedScript so misuse is caught early. This keeps
the existing replacements but prevents accidental non-JSON-literal inputs from
being silently processed.

packages/vite-plugin/src/virtuals/icons.ts (1)

101-109: Recommended follow-up: apply the same hardening to other virtual codegen sinks.

You still have direct JSON.stringify(...) embedding in:

• packages/vite-plugin/src/virtuals/_shared.ts (lines 88-93),
• packages/vite-plugin/src/virtuals/single-project.ts (lines 4-14),
• packages/vite-plugin/src/virtuals/mmd.ts (lines 26-30).

Using the same helper there would make this mitigation consistent.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@packages/vite-plugin/src/virtuals/icons.ts` around lines 101 - 109, Other
virtual codegen sinks still embed JSON via direct JSON.stringify; update them to
use the same hardening helper as used here: replace JSON.stringify(...)
embeddings with
hardenJsonStringLiteralForEmbeddedScript(embed...AsJsString(...)) calls (reusing
embedProjectIdAsJsString/embedUrlAsJsString where appropriate) so the generated
literals are hardened before injecting into code; check the virtual generators
mentioned (virtuals/_shared.ts, virtuals/single-project.ts, virtuals/mmd.ts) and
swap the raw JSON.stringify usages for hardenJsonStringLiteralForEmbeddedScript
wrapping the corresponding embed*AsJsString helpers, keeping the import usage
consistent with joinURL and IconRenderer patterns already used in icons.ts.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes