From 62a63f213ba393c93f2cec1ec2fa6523c30e72b6 Mon Sep 17 00:00:00 2001 From: ByteYue Date: Fri, 20 Mar 2026 10:37:21 +0800 Subject: [PATCH] fix: use JSON.stringify for safe JS string interpolation in evaluate() Replace ad-hoc string escaping with JSON.stringify() for values interpolated into JavaScript code strings passed to page.evaluate(). - explore.ts: clickLabels were escaped with only single-quote replacement, which breaks on labels containing backslashes or newlines. JSON.stringify() handles all edge cases correctly. - synthesize.ts: buildEvaluateScript() embedded URLs directly inside single quotes. JSON.stringify() safely handles URLs containing special characters. --- src/explore.ts | 4 ++-- src/synthesize.ts | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/explore.ts b/src/explore.ts index 1eaa0fc..d135509 100644 --- a/src/explore.ts +++ b/src/explore.ts @@ -319,11 +319,11 @@ export async function exploreUrl( // First: targeted clicks by label (e.g. "字幕", "CC", "评论") if (opts.clickLabels?.length) { for (const label of opts.clickLabels) { - const safeLabel = label.replace(/'/g, "\\'"); + const safeLabel = JSON.stringify(label); await page.evaluate(` (() => { const el = [...document.querySelectorAll('button, [role="button"], [role="tab"], a, span')] - .find(e => e.textContent && e.textContent.trim().includes('${safeLabel}')); + .find(e => e.textContent && e.textContent.trim().includes(${safeLabel})); if (el) el.click(); })() `); diff --git a/src/synthesize.ts b/src/synthesize.ts index c979b16..333f0cd 100644 --- a/src/synthesize.ts +++ b/src/synthesize.ts @@ -116,7 +116,7 @@ function buildEvaluateScript(url: string, itemPath: string, endpoint: any): stri return [ '(async () => {', - ` const res = await fetch('${url}', {`, + ` const res = await fetch(${JSON.stringify(url)}, {`, ` credentials: 'include'`, ' });', ' const data = await res.json();',