From e22e05d24a020ac8dc6294896bbf0f454bf04578 Mon Sep 17 00:00:00 2001 From: Marko Lahma Date: Sun, 26 Jul 2026 21:02:03 +0300 Subject: [PATCH] Parse import maps as JSON instead of interpolating them into script `LoadImportMap` builds the source string `JSON.parse('')` and evaluates it. The content of a `"; + var document = await context.OpenAsync(r => r.Content(html)); + Assert.IsNull(document.GetElementById("test")); + } + + [Test] + public async Task ImportMapContentIsNotEvaluatedAsScript() + { + var config = Configuration.Default.WithJs(); + var context = BrowsingContext.New(config); + var html = "
Test
"; + var document = await context.OpenAsync(r => r.Content(html)); + Assert.IsNotNull(document.GetElementById("test")); + } + [Test] public async Task ModuleScriptWithAbsoluteUrlImportMapShouldRun() { diff --git a/src/AngleSharp.Js/EngineInstance.cs b/src/AngleSharp.Js/EngineInstance.cs index fe3d678..e0f7411 100644 --- a/src/AngleSharp.Js/EngineInstance.cs +++ b/src/AngleSharp.Js/EngineInstance.cs @@ -5,6 +5,7 @@ namespace AngleSharp.Js using AngleSharp.Text; using Jint; using Jint.Native; + using Jint.Native.Json; using Jint.Native.Object; using System; using System.Collections.Generic; @@ -117,7 +118,10 @@ public JsValue RunScript(String source, String type, String sourceUrl, JsValue c private JsValue LoadImportMap(String source) { - var importMap = _engine.Evaluate($"JSON.parse('{source}')").AsObject(); + // The source is page content, so it must be handed to a JSON parser rather + // than pasted into a script: a single quote already breaks the parse, and + // anything after a closing quote would run as script. + var importMap = new JsonParser(_engine).Parse(source).AsObject(); if (importMap.TryGetValue("scopes", out var scopes)) {