From 0bec0f13d18b75e3a8f83b3e3f50c776ba6afc2e Mon Sep 17 00:00:00 2001 From: pandeymangg Date: Tue, 21 Jul 2026 12:50:15 +0530 Subject: [PATCH 1/3] fixes the js payload backtick bug --- packages/react-native/src/components/survey-web-view.tsx | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/packages/react-native/src/components/survey-web-view.tsx b/packages/react-native/src/components/survey-web-view.tsx index 36a74cd..2e454e8 100644 --- a/packages/react-native/src/components/survey-web-view.tsx +++ b/packages/react-native/src/components/survey-web-view.tsx @@ -372,7 +372,11 @@ const renderHtml = ( function getSetIsError() { /* noop */ }; function loadSurvey() { - const options = ${JSON.stringify(options)}; + // Escape "<" so survey content can't inject "" (or " Date: Tue, 21 Jul 2026 13:02:06 +0530 Subject: [PATCH 2/3] refactor: satisfy sonar for payload escaping (ENG-1813) Move the "<" escaping into a `const optionsJson` before the template and use `replaceAll` + `String.raw` instead of `replace(/. Co-Authored-By: Claude Opus 4.8 (1M context) --- .../src/components/survey-web-view.tsx | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/packages/react-native/src/components/survey-web-view.tsx b/packages/react-native/src/components/survey-web-view.tsx index 2e454e8..7f5502d 100644 --- a/packages/react-native/src/components/survey-web-view.tsx +++ b/packages/react-native/src/components/survey-web-view.tsx @@ -336,6 +336,15 @@ const renderHtml = ( `; } + // Escape "<" so survey content can't inject "" (or " below: "<" occurs only inside JSON string values, and the + // WebView's JS engine decodes the escaped "<" back to a literal "<" when parsing the + // object literal, so the payload is preserved exactly. See ENG-1813. + const optionsJson = JSON.stringify(options).replaceAll( + "<", + String.raw`\u003c`, + ); + return ` @@ -372,11 +381,7 @@ const renderHtml = ( function getSetIsError() { /* noop */ }; function loadSurvey() { - // Escape "<" so survey content can't inject "" (or " Date: Tue, 21 Jul 2026 14:13:22 +0530 Subject: [PATCH 3/3] run checks