3.23.2
85def9a
This commit was signed with the committer’s verified signature.
freekmurze
Freek Van der Herten
What's Changed
Backport of the </script> break-out fix (#242) onto the 3.x line, so projects still on spatie/schema-org 3.x can apply the security patch without upgrading to 4.x.
toScript() now adds JSON_HEX_TAG to the json_encode flags. The < and > characters in property values are now serialized as their JSON unicode escapes instead of raw angle brackets, which is valid JSON-LD but cannot be parsed as an HTML tag. This neutralizes the break-out vector reported in the advisory (affected: 3.23.1 through 4.0.1).
Thanks to @hacklian for reporting (#243) and supplying the backport patch.
Full Changelog: 3.23.1...3.23.2
Contributors
hacklian