Potential fix for code scanning alert no. 39: Improper code sanitization

[Tanker187]

Potential fix for https://github.com/Tanker187/vite/security/code-scanning/39

In general, to fix this kind of issue you should not rely on JSON.stringify alone when embedding potentially user-controlled strings into generated JavaScript source code. Instead, apply an additional escaping step that replaces characters problematic in HTML/script contexts (<, >, /, certain Unicode line separators, etc.) with safe escape sequences so that, even if the code is inlined into a <script> tag, no string value can prematurely terminate the script or inject new code.

For this specific file, the best fix is to introduce a small helper function (local to this module) that escapes unsafe characters in a string already processed by JSON.stringify. Then, update all uses of JSON.stringify that feed into constructed code strings (importPath, importKey, filePath) to pass their result through this helper. Concretely:

• Add a const map JS_UNSAFE_CHARS and a function escapeUnsafeCharsForJs(str: string): string near the top of importMetaGlob.ts (after the imports) that replaces characters like <, >, /, backslash, control characters, and the Unicode line/paragraph separators \u2028 and \u2029.
• Replace JSON.stringify(importPath) with escapeUnsafeCharsForJs(JSON.stringify(importPath)) in the construction of staticImports (line 546) and importStatement (line 554).
• Replace JSON.stringify(importKey) with escapeUnsafeCharsForJs(JSON.stringify(importKey)) in the .then(m => m[...]) expression (line 556).
• Replace JSON.stringify(filePath) with escapeUnsafeCharsForJs(JSON.stringify(filePath)) in all places where filePath is embedded into objectProps (lines 523, 551, 560).

No new external dependencies are needed; the helper can be implemented with built-in JavaScript string operations. Existing functionality is preserved because valid paths/keys will produce equivalent JavaScript strings, just with additional escapes for characters that would otherwise be interpreted specially by HTML/script parsers.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.