inline-json-for-html

Why this boundary needs a separate serializer

A JSON string can contain an HTML script end tag. When JSON is inserted into a script element as raw text, the HTML parser may close the element before JavaScript reads that data. The example uses a harmless, synthetic paragraph tag to make the boundary visible.

Run a small public example

Use Node.js 22 or newer. The package is distributed from its versioned GitHub release; npm registry publication is not claimed.

npm install github:edilec/inline-json-for-html#v0.1.1

import { serializeInlineJson } from 'inline-json-for-html'

const value = { message: '</script><p>outside</p>', note: 'synthetic fixture' }
const text = serializeInlineJson(value)
console.log(text)

The released serializer returns this JSON text for the synthetic value:

{"message":"\u003C/script\u003E\u003Cp\u003Eoutside\u003C/p\u003E","note":"synthetic fixture"}

The serialized text contains no literal </script> end tag. JSON.parse reconstructs the original message, including its angle brackets. This is a synthetic parser-boundary example, not a claim that an application is otherwise secure.

Place the returned text inside an HTML application/json script element, then read its textContent and parse it with JSON.parse. The repository includes a complete page-rendering example.

Inspect the checked-in runnable example

The supported context and its limits

The output is for the raw text of an HTML script element that carries JSON data. It is not a general HTML sanitizer or an encoder for JavaScript source, attributes, event handlers, URLs, CSS or arbitrary markup. Use context-specific controls for those other destinations and review the full threat model before adoption.

Read the project threat model · Review OWASP's output-context guidance

Continue the web security review

• Web development at Edilec
• Cybersecurity work at Edilec
• Browse all open-source tools

Review the boundary in a real web workflow

Edilec can help identify where a web application moves data into HTML, JavaScript and API responses, then test the relevant output context. Share only non-sensitive details you are permitted to disclose.

Discuss a web data boundary