From 327f287684953e29272fb3c2734972e1cacc9146 Mon Sep 17 00:00:00 2001
From: Ardis Lu <ardisglu@gmail.com>
Date: Tue, 29 Sep 2026 23:36:49 -0700
Subject: [PATCH] Do not manually stringify `envpass` object

Just using `JSON.stringify` will avoid easy mistakes like omitting/including quotes around properties inappropriately.
---
 src/getPrf.js | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/getPrf.js b/src/getPrf.js
index a507f8f..a6ccfc0 100644
--- a/src/getPrf.js
+++ b/src/getPrf.js
@@ -101,10 +101,10 @@ export async function getPrf(options = {}) {
   const challenge = crypto.getRandomValues(new Uint8Array(32)).toHex();
 
   // Setup injection in the HTML template, including hashes of <style> and <script> contents for the CSP header
-  const injectedScript = `
-    const envpass = {
-      exp: ${timeoutExp}
-    }; ${script}`;
+  const envpass = {
+    exp: timeoutExp
+  }
+  const injectedScript = `const envpass = ${JSON.stringify(envpass)}; ${script}`;
   const styleHash = new Uint8Array(await crypto.subtle.digest('SHA-512', encoder.encode(style))).toBase64();
   const scriptHash = new Uint8Array(await crypto.subtle.digest('SHA-512', encoder.encode(injectedScript))).toBase64();
   html = html.replace(/(<script.*)>[\s\S]*<\/script>/i, `$1 integrity="sha512-${scriptHash}">${injectedScript}</script>`);
-- 
2.47.3