Merge pull request from GHSA-997g-27x8-43rf

Co-authored-by: Lenz Weber-Tronic <lorenz.weber-tronic@apollographql.com>

Author: TkDodo

packages/react-query-next-experimental/src/HydrationStreamProvider.tsx

@@ -2,6 +2,7 @@
 
 import { useServerInsertedHTML } from 'next/navigation'
 import * as React from 'react'
+import { htmlEscapeJsonString } from './htmlescape'
 
 const serializedSymbol = Symbol('serialized')
 
@@ -83,7 +84,7 @@ export function createHydrationStreamProvider<TShape>() {
   }) {
     // unique id for the cache provider
     const id = `__RQ${React.useId()}`
-    const idJSON = JSON.stringify(id)
+    const idJSON = htmlEscapeJsonString(JSON.stringify(id))
 
     const [transformer] = React.useState(
       () =>
@@ -124,7 +125,7 @@ export function createHydrationStreamProvider<TShape>() {
 
       const html: Array<string> = [
         `window[${idJSON}] = window[${idJSON}] || [];`,
-        `window[${idJSON}].push(${serializedCacheArgs});`,
+        `window[${idJSON}].push(${htmlEscapeJsonString(serializedCacheArgs)});`,
       ]
       return (
         <script

packages/react-query-next-experimental/src/htmlescape.ts

@@ -0,0 +1,24 @@
+// --------------------------------------------------------------------------------
+//
+// copied from
+// https://github.com/vercel/next.js/blob/6bc07792a4462a4bf921a72ab30dc4ab2c4e1bda/packages/next/src/server/htmlescape.ts
+// License: https://github.com/vercel/next.js/blob/6bc07792a4462a4bf921a72ab30dc4ab2c4e1bda/packages/next/license.md
+//
+// --------------------------------------------------------------------------------
+
+// This utility is based on https://github.com/zertosh/htmlescape
+// License: https://github.com/zertosh/htmlescape/blob/0527ca7156a524d256101bb310a9f970f63078ad/LICENSE
+
+const ESCAPE_LOOKUP: { [match: string]: string } = {
+  "&": "\\u0026",
+  ">": "\\u003e",
+  "<": "\\u003c",
+  "\u2028": "\\u2028",
+  "\u2029": "\\u2029",
+};
+
+export const ESCAPE_REGEX = /[&><\u2028\u2029]/g;
+
+export function htmlEscapeJsonString(str: string): string {
+  return str.replace(ESCAPE_REGEX, (match) => ESCAPE_LOOKUP[match]);
+}