From 6e07ed20816969bfd1c6c06eb518171938312782 Mon Sep 17 00:00:00 2001
From: Louis Lam <louislam@users.noreply.github.com>
Date: Fri, 7 Oct 2022 15:02:19 +0800
Subject: [PATCH] Fix #2186

---
 package-lock.json           | 41 +++++++++++++++++++++++++++----------
 package.json                |  1 +
 server/model/status_page.js | 15 ++++++++++----
 3 files changed, 42 insertions(+), 15 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 71827042..4f222171 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
     "name": "uptime-kuma",
-    "version": "1.18.2",
+    "version": "1.18.3",
     "lockfileVersion": 2,
     "requires": true,
     "packages": {
         "": {
             "name": "uptime-kuma",
-            "version": "1.18.2",
+            "version": "1.18.3",
             "license": "MIT",
             "dependencies": {
                 "@louislam/sqlite3": "~15.0.6",
@@ -33,6 +33,7 @@
                 "http-proxy-agent": "^5.0.0",
                 "https-proxy-agent": "^5.0.0",
                 "iconv-lite": "^0.6.3",
+                "jsesc": "^3.0.2",
                 "jsonwebtoken": "~8.5.1",
                 "jwt-decode": "^3.1.2",
                 "limiter": "^2.1.0",
@@ -474,6 +475,18 @@
                 "node": ">=6.9.0"
             }
         },
+        "node_modules/@babel/generator/node_modules/jsesc": {
+            "version": "2.5.2",
+            "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-2.5.2.tgz",
+            "integrity": "sha512-OYu7XEzjkCQ3C5Ps3QIZsQfNpqoJyZZA99wd9aWd05NCtC5pWOkShK2mkL6HXQR6/Cy2lbNdPlZBpuQHXE63gA==",
+            "dev": true,
+            "bin": {
+                "jsesc": "bin/jsesc"
+            },
+            "engines": {
+                "node": ">=4"
+            }
+        },
         "node_modules/@babel/helper-annotate-as-pure": {
             "version": "7.18.6",
             "resolved": "https://registry.npmjs.org/@babel/helper-annotate-as-pure/-/helper-annotate-as-pure-7.18.6.tgz",
@@ -11229,15 +11242,14 @@
             "dev": true
         },
         "node_modules/jsesc": {
-            "version": "2.5.2",
-            "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-2.5.2.tgz",
-            "integrity": "sha512-OYu7XEzjkCQ3C5Ps3QIZsQfNpqoJyZZA99wd9aWd05NCtC5pWOkShK2mkL6HXQR6/Cy2lbNdPlZBpuQHXE63gA==",
-            "dev": true,
+            "version": "3.0.2",
+            "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-3.0.2.tgz",
+            "integrity": "sha512-xKqzzWXDttJuOcawBt4KnKHHIf5oQ/Cxax+0PWFG+DFDgHNAdi+TXECADI+RYiFUMmx8792xsMbbgXj4CwnP4g==",
             "bin": {
                 "jsesc": "bin/jsesc"
             },
             "engines": {
-                "node": ">=4"
+                "node": ">=6"
             }
         },
         "node_modules/json-parse-even-better-errors": {
@@ -16957,6 +16969,14 @@
                 "@babel/types": "^7.18.13",
                 "@jridgewell/gen-mapping": "^0.3.2",
                 "jsesc": "^2.5.1"
+            },
+            "dependencies": {
+                "jsesc": {
+                    "version": "2.5.2",
+                    "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-2.5.2.tgz",
+                    "integrity": "sha512-OYu7XEzjkCQ3C5Ps3QIZsQfNpqoJyZZA99wd9aWd05NCtC5pWOkShK2mkL6HXQR6/Cy2lbNdPlZBpuQHXE63gA==",
+                    "dev": true
+                }
             }
         },
         "@babel/helper-annotate-as-pure": {
@@ -25010,10 +25030,9 @@
             }
         },
         "jsesc": {
-            "version": "2.5.2",
-            "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-2.5.2.tgz",
-            "integrity": "sha512-OYu7XEzjkCQ3C5Ps3QIZsQfNpqoJyZZA99wd9aWd05NCtC5pWOkShK2mkL6HXQR6/Cy2lbNdPlZBpuQHXE63gA==",
-            "dev": true
+            "version": "3.0.2",
+            "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-3.0.2.tgz",
+            "integrity": "sha512-xKqzzWXDttJuOcawBt4KnKHHIf5oQ/Cxax+0PWFG+DFDgHNAdi+TXECADI+RYiFUMmx8792xsMbbgXj4CwnP4g=="
         },
         "json-parse-even-better-errors": {
             "version": "2.3.1",
diff --git a/package.json b/package.json
index df0bdbfb..d478a1d2 100644
--- a/package.json
+++ b/package.json
@@ -88,6 +88,7 @@
         "http-proxy-agent": "^5.0.0",
         "https-proxy-agent": "^5.0.0",
         "iconv-lite": "^0.6.3",
+        "jsesc": "^3.0.2",
         "jsonwebtoken": "~8.5.1",
         "jwt-decode": "^3.1.2",
         "limiter": "^2.1.0",
diff --git a/server/model/status_page.js b/server/model/status_page.js
index 82d184bf..7682272c 100644
--- a/server/model/status_page.js
+++ b/server/model/status_page.js
@@ -2,6 +2,7 @@ const { BeanModel } = require("redbean-node/dist/bean-model");
 const { R } = require("redbean-node");
 const cheerio = require("cheerio");
 const { UptimeKumaServer } = require("../uptime-kuma-server");
+const jsesc = require("jsesc");
 
 class StatusPage extends BeanModel {
 
@@ -56,13 +57,19 @@ class StatusPage extends BeanModel {
         head.append(`<meta property="og:description" content="${description155}" />`);
 
         // Preload data
-        const json = JSON.stringify(await StatusPage.getStatusPageData(statusPage));
-        head.append(`
-            <script>
-                window.preloadData = ${json}
+        // Add jsesc, fix https://github.com/louislam/uptime-kuma/issues/2186
+        const escapedJSONObject = jsesc(JSON.stringify(await StatusPage.getStatusPageData(statusPage)), {
+            "isScriptContext": true
+        });
+
+        const script = $(`
+            <script id="preload-data" data-json="{}">
+                window.preloadData = ${escapedJSONObject};
             </script>
         `);
 
+        head.append(script);
+
         // manifest.json
         $("link[rel=manifest]").attr("href", `/api/status-page/${statusPage.slug}/manifest.json`);