What is the proper way to escape JSON that may contain HTML before rendering it in HTML document?
I found many similar questions, but not one that would discuss this scenario. app.get('/', function(req, res) { res.set('Content-Type', 'text/html'); res.send(`<html> <body> Hello, World! </body> <script> const test = ${JSON.stringify({html: '</script><script>alert(1)</script>'})}; </script> </html>`); }); This will produce HTML as follows: <html>…