diff --git a/packages/react-native/src/components/survey-web-view.tsx b/packages/react-native/src/components/survey-web-view.tsx index 36a74cd..7f5502d 100644 --- a/packages/react-native/src/components/survey-web-view.tsx +++ b/packages/react-native/src/components/survey-web-view.tsx @@ -336,6 +336,15 @@ const renderHtml = ( `; } + // Escape "<" so survey content can't inject "" (or " below: "<" occurs only inside JSON string values, and the + // WebView's JS engine decodes the escaped "<" back to a literal "<" when parsing the + // object literal, so the payload is preserved exactly. See ENG-1813. + const optionsJson = JSON.stringify(options).replaceAll( + "<", + String.raw`\u003c`, + ); + return ` @@ -372,7 +381,7 @@ const renderHtml = ( function getSetIsError() { /* noop */ }; function loadSurvey() { - const options = ${JSON.stringify(options)}; + const options = ${optionsJson}; const surveyProps = { ...options, onDisplayCreated,