From: Ardis Lu <ardisglu@gmail.com>
Date: Wed, 30 Sep 2026 06:36:49 +0000 (-0700)
Subject: Do not manually stringify `envpass` object
X-Git-Url: https://git.ardis.lu/?a=commitdiff_plain;h=327f287684953e29272fb3c2734972e1cacc9146;p=envpass

Do not manually stringify `envpass` object

Just using `JSON.stringify` will avoid easy mistakes like omitting/including quotes around properties inappropriately.
---

diff --git a/src/getPrf.js b/src/getPrf.js
index a507f8f..a6ccfc0 100644
--- a/src/getPrf.js
+++ b/src/getPrf.js
@@ -101,10 +101,10 @@ export async function getPrf(options = {}) {
   const challenge = crypto.getRandomValues(new Uint8Array(32)).toHex();
 
   // Setup injection in the HTML template, including hashes of <style> and <script> contents for the CSP header
-  const injectedScript = `
-    const envpass = {
-      exp: ${timeoutExp}
-    }; ${script}`;
+  const envpass = {
+    exp: timeoutExp
+  }
+  const injectedScript = `const envpass = ${JSON.stringify(envpass)}; ${script}`;
   const styleHash = new Uint8Array(await crypto.subtle.digest('SHA-512', encoder.encode(style))).toBase64();
   const scriptHash = new Uint8Array(await crypto.subtle.digest('SHA-512', encoder.encode(injectedScript))).toBase64();
   html = html.replace(/(<script.*)>[\s\S]*<\/script>/i, `$1 integrity="sha512-${scriptHash}">${injectedScript}</script>`);