From 16fd18373672604128992ab7fd6899972a8c1aa4 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 4 Nov 2026 08:43:08 +0000
Subject: [PATCH] Escape <, >, &, U+2028 and U+2029 in the JSON-LD script

JsonLd.astro wrote JSON.stringify(data) raw into
<script type="application/ld+json">. A string holding </script> ended
the element early and put the rest of the JSON into the page as HTML,
and <!--<script> made the element swallow the rest of the page. Article
titles and excerpts come from the content repository, so an article
could trigger it.

serializeJsonLd (src/lib/json-ld.mjs) writes those characters as \u
escapes. The JSON parses to the same value, so search engines read the
same data. tests/json-ld.test.mjs covers it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013MdjUcGUV9BPmxbz46Ac8n
---
 src/components/JsonLd.astro |  4 +++-
 src/lib/json-ld.mjs         | 11 +++++++++++
 tests/json-ld.test.mjs      | 23 +++++++++++++++++++++++
 3 files changed, 37 insertions(+), 1 deletion(-)
 create mode 100644 src/lib/json-ld.mjs
 create mode 100644 tests/json-ld.test.mjs

diff --git a/src/components/JsonLd.astro b/src/components/JsonLd.astro
index 4866788..69c2a1e 100644
--- a/src/components/JsonLd.astro
+++ b/src/components/JsonLd.astro
@@ -1,4 +1,6 @@
 ---
+import { serializeJsonLd } from '../lib/json-ld.mjs';
+
 const { data } = Astro.props;
 ---
-<script type="application/ld+json" set:html={JSON.stringify(data)} />
\ No newline at end of file
+<script type="application/ld+json" set:html={serializeJsonLd(data)} />
\ No newline at end of file
diff --git a/src/lib/json-ld.mjs b/src/lib/json-ld.mjs
new file mode 100644
index 0000000..4180378
--- /dev/null
+++ b/src/lib/json-ld.mjs
@@ -0,0 +1,11 @@
+// JSON-LD for a <script type="application/ld+json"> element, which the browser ends at the first `</script`.
+
+const UNSAFE = /[<>&\u2028\u2029]/g;
+
+/**
+ * `data` as JSON, with `<`, `>`, `&`, U+2028 and U+2029 written as `\u` escapes. A string holding `</script>` or `<!--`
+ * then stays inside the script element, and the JSON still parses to the same value.
+ */
+export function serializeJsonLd(data) {
+  return JSON.stringify(data).replace(UNSAFE, (char) => `\\u${char.charCodeAt(0).toString(16).padStart(4, '0')}`);
+}
diff --git a/tests/json-ld.test.mjs b/tests/json-ld.test.mjs
new file mode 100644
index 0000000..3bfab98
--- /dev/null
+++ b/tests/json-ld.test.mjs
@@ -0,0 +1,23 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { serializeJsonLd } from '../src/lib/json-ld.mjs';
+
+test('JSON-LD escapes <, >, &, U+2028 and U+2029 and still parses to the same value', () => {
+  const data = {
+    '@type': 'BlogPosting',
+    headline: 'Ends early </script><b>x</b> & <!-- comment --> > done',
+    description: 'Line\u2028and paragraph\u2029separators',
+    keywords: ['</SCRIPT >', 'a&b'],
+  };
+  const json = serializeJsonLd(data);
+  // With no `<` left, the browser can't find `</script` or `<!--`, so the whole JSON stays in the script element.
+  assert.doesNotMatch(json, /[<>&\u2028\u2029]/);
+  assert.match(json, /"Ends early \\u003c\/script\\u003e\\u003cb\\u003ex\\u003c\/b\\u003e \\u0026 \\u003c!-- comment/);
+  assert.match(json, /"Line\\u2028and paragraph\\u2029separators"/);
+  assert.deepEqual(JSON.parse(json), data);
+});
+
+test('JSON-LD without those characters is plain JSON.stringify', () => {
+  const data = { '@context': 'https://schema.org', name: 'meaningfool', sameAs: ['https://github.com/meaningfool'] };
+  assert.equal(serializeJsonLd(data), JSON.stringify(data));
+});