fix(landing): escape </script> breakout in the static public-env script

waleedlatif1 · waleedlatif1 · commit 87cd4e5149d9 · 2026-07-08T17:40:21.000-07:00
Greptile P1: a NEXT_PUBLIC_* value containing "&lt;/script&gt;" would close the
inline script early and could inject markup/script into every hosted page.
Escape "&lt;" in the serialized JSON before interpolating it, matching the
standard JSON-in-script-tag safeguard.
diff --git a/apps/sim/app/_shell/public-env-script.tsx b/apps/sim/app/_shell/public-env-script.tsx
@@ -19,13 +19,17 @@ const HOSTED_PUBLIC_ENV = Object.fromEntries(
  * for self-hosted Docker images that re-inject env per deploy without a
  * rebuild. On hosted, env is fixed per build, so this is safe to render
  * statically alongside the marketing pages' `revalidate`.
+ *
+ * Escapes `<` in the serialized JSON so an env value containing `</script>`
+ * can't close this tag early and inject markup into every hosted page.
  */
 export function PublicEnvScript() {
+  const serialized = JSON.stringify(HOSTED_PUBLIC_ENV).replace(/</g, '\\u003c')
   return (
     <script
       id='public-env'
       dangerouslySetInnerHTML={{
-        __html: `window['${PUBLIC_ENV_KEY}'] = ${JSON.stringify(HOSTED_PUBLIC_ENV)}`,
+        __html: `window['${PUBLIC_ENV_KEY}'] = ${serialized}`,
       }}
     />
   )
