fix: use JSON.stringify for safe JS string interpolation in evaluate() (#109)

Replace ad-hoc string escaping with JSON.stringify() for values
interpolated into JavaScript code strings passed to page.evaluate().

- explore.ts: clickLabels were escaped with only single-quote
  replacement, which breaks on labels containing backslashes or
  newlines. JSON.stringify() handles all edge cases correctly.

- synthesize.ts: buildEvaluateScript() embedded URLs directly inside
  single quotes. JSON.stringify() safely handles URLs containing
  special characters.
This commit is contained in:
AlexYue authored and GitHub committed 2026-03-20 10:47:09 +08:00
1 parent 40846291e6
commit 390dbe7199
2 files changed
+3 -3

No files matched your search

+2 -2
View File
@@ -250,11 +250,11 @@ export async function exploreUrl(
// First: targeted clicks by label (e.g. "字幕", "CC", "评论")
if (opts.clickLabels?.length) {
for (const label of opts.clickLabels) {
const safeLabel = label.replace(/'/g, "\\'");
const safeLabel = JSON.stringify(label);
await page.evaluate(`
(() => {
const el = [...document.querySelectorAll('button, [role="button"], [role="tab"], a, span')]
.find(e => e.textContent && e.textContent.trim().includes('${safeLabel}'));
.find(e => e.textContent && e.textContent.trim().includes(${safeLabel}));
if (el) el.click();
})()
`);
+1 -1
View File
@@ -116,7 +116,7 @@ function buildEvaluateScript(url: string, itemPath: string, endpoint: any): stri
return [
'(async () => {',
` const res = await fetch('${url}', {`,
` const res = await fetch(${JSON.stringify(url)}, {`,
` credentials: 'include'`,
' });',
' const data = await res.json();',