Stream: git-wasmtime

Topic: wasmtime / PR #14963 explorer: escape `<` in the json emb...

Wasmtime GitHub notifications bot (Oct 23 2026 at 14:40):

netliomax25-code removed the review request for wasmtime-core-reviewers from PR #14963.

Wasmtime GitHub notifications bot (Oct 23 2026 at 14:40):

netliomax25-code opened PR #14963 from netliomax25-code:explorer-escape-script-json to bytecodealliance:main:

wasmtime explore writes the annotated WAT, disassembly and CLIF into the generated page as JSON inside <script> elements, using serde_json::to_string. That serializer leaves < alone, so any string copied out of the module (an export or import name, a data segment as printed by wasmprinter, a function name from the name section) is emitted verbatim. A module containing </script> ends the script element early, and whatever follows is parsed as markup and script by the browser the developer opens the page in.

This routes the three JSON blobs through a small helper that replaces < with the equivalent JSON escape \u003c. The JavaScript parser decodes it back to the same string, so the rendered WAT and names are unchanged. The new unit test generates a page from a module whose export name and data segment contain </script> and checks that only the page's own two closing tags remain; it fails before this change and passes after.

Tested with cargo test -p wasmtime-internal-explorer --lib, cargo fmt --all -- --check and cargo clippy -p wasmtime-internal-explorer --all-targets.

Wasmtime GitHub notifications bot (Oct 23 2026 at 14:40):

netliomax25-code requested dicej for a review on PR #14963.

Wasmtime GitHub notifications bot (Oct 23 2026 at 14:40):

netliomax25-code requested wasmtime-core-reviewers for a review on PR #14963.

Wasmtime GitHub notifications bot (Oct 23 2026 at 15:02):

:thumbs_up: dicej submitted PR review:

Thanks!

One small suggestion: consider adding another test that verifies that serde_json::from_str(to_script_json(json_with_angle_bracket)) == json_with_angle_bracket as a sanity check that we used the right escape code.

Wasmtime GitHub notifications bot (Oct 27 2026 at 07:07):

netliomax25-code updated PR #14963.

Wasmtime GitHub notifications bot (Oct 27 2026 at 07:07):

netliomax25-code commented on PR #14963:

Makes sense. Pushed a second test, script_json_round_trips_angle_brackets, which runs a few strings with < and </script> through to_script_json, checks the output has no raw < left, and then serde_json::from_strs it back and compares against the original. Verified locally with cargo test -p wasmtime-internal-explorer --lib (5 passed), plus fmt and clippy.

Last updated: Oct 31 2026 at 23:03 UTC