Security: escape HTML-breakout sequences in injected JSON-LD

The MkDocs hook embedded schema.org Dataset JSON-LD into page HTML via
json.dumps, which does not escape < > &. A concept whose title/description/
tags contained a literal </script> could close the JSON-LD block and inject
executable markup — stored XSS on any site built from a bundle with
third-party-contributed concepts (the tutorial ships this hook as a template
to copy). Escape < > & to their \uXXXX JSON forms (still valid JSON-LD).
Regression test in tests/test_hooks.py.

Author: nicholsn

docs/hooks/lokf_hooks.py

@@ -53,11 +53,27 @@ def _graph_json() -> str:
     return _cache["graph_json"]
 
 
+def _ldjson_script(doc: dict) -> str:
+    """A JSON-LD ``<script>`` block, escaped so string content can't break out.
+
+    ``json.dumps`` does not escape ``<``/``>``/``&``, so a concept field
+    containing ``</script>`` would otherwise terminate the block and inject
+    markup into the page. The ``\\uXXXX`` forms stay valid JSON, so the
+    JSON-LD remains parseable.
+    """
+    payload = (
+        json.dumps(doc)
+        .replace("<", "\\u003c")
+        .replace(">", "\\u003e")
+        .replace("&", "\\u0026")
+    )
+    return '<script type="application/ld+json">' + payload + "</script>"
+
+
 def _jsonld_blocks() -> str:
     if "jsonld_blocks" not in _cache:
         _cache["jsonld_blocks"] = "\n".join(
-            '<script type="application/ld+json">' + json.dumps(doc) + "</script>"
-            for doc in dataset_search_jsonld(_bundle())
+            _ldjson_script(doc) for doc in dataset_search_jsonld(_bundle())
         )
     return _cache["jsonld_blocks"]
 

tests/test_hooks.py

@@ -0,0 +1,23 @@
+"""The JSON-LD injection escapes HTML-breakout sequences."""
+import importlib.util
+import pathlib
+
+ROOT = pathlib.Path(__file__).parent.parent
+_spec = importlib.util.spec_from_file_location(
+    "lokf_hooks", ROOT / "docs" / "hooks" / "lokf_hooks.py"
+)
+hooks = importlib.util.module_from_spec(_spec)
+_spec.loader.exec_module(hooks)
+
+
+def test_ldjson_script_escapes_script_breakout():
+    doc = {"name": "</script><script>alert(1)</script>", "@type": "Dataset"}
+    block = hooks._ldjson_script(doc)
+    # The raw closing tag must not survive inside the payload.
+    inner = block[len('<script type="application/ld+json">'):-len("</script>")]
+    assert "</script>" not in inner
+    assert "<" not in inner and ">" not in inner
+    # Still valid JSON, and round-trips back to the original string.
+    import json
+
+    assert json.loads(inner)["name"] == "</script><script>alert(1)</script>"