Escape HTML in scroll restoration keys (#14705)

Author: brophdawg11

.changeset/fuzzy-worms-decide.md

@@ -0,0 +1,5 @@
+---
+"react-router": patch
+---
+
+Escape HTML in scroll restoration keys

packages/react-router/lib/dom/lib.tsx

@@ -97,6 +97,7 @@ import {
 } from "../hooks";
 import type { SerializeFrom } from "../types/route-data";
 import type { unstable_ClientInstrumentation } from "../router/instrumentation";
+import { escapeHtml } from "./ssr/markup";
 
 ////////////////////////////////////////////////////////////////////////////////
 //#region Global Stuff
@@ -2033,9 +2034,9 @@ export function ScrollRestoration({
       {...props}
       suppressHydrationWarning
       dangerouslySetInnerHTML={{
-        __html: `(${restoreScroll})(${JSON.stringify(
-          storageKey || SCROLL_RESTORATION_STORAGE_KEY,
-        )}, ${JSON.stringify(ssrKey)})`,
+        __html: `(${restoreScroll})(${escapeHtml(
+          JSON.stringify(storageKey || SCROLL_RESTORATION_STORAGE_KEY),
+        )}, ${escapeHtml(JSON.stringify(ssrKey))})`,
       }}
     />
   );

packages/react-router/lib/dom/server.tsx

@@ -35,6 +35,7 @@ import {
   ViewTransitionContext,
 } from "../context";
 import { useRoutesImpl } from "../hooks";
+import { escapeHtml } from "./ssr/markup";
 
 /**
  * @category Types
@@ -187,7 +188,7 @@ export function StaticRouterProvider({
     // up parsing on the client.  Dual-stringify is needed to ensure all quotes
     // are properly escaped in the resulting string.  See:
     //   https://v8.dev/blog/cost-of-javascript-2019#json
-    let json = htmlEscape(JSON.stringify(JSON.stringify(data)));
+    let json = escapeHtml(JSON.stringify(JSON.stringify(data)));
     hydrateScript = `window.__staticRouterHydrationData = JSON.parse(${json});`;
   }
 
@@ -520,19 +521,3 @@ function encodeLocation(to: To): Path {
 }
 
 const ABSOLUTE_URL_REGEX = /^(?:[a-z][a-z0-9+.-]*:|\/\/)/i;
-
-// This utility is based on https://github.com/zertosh/htmlescape
-// License: https://github.com/zertosh/htmlescape/blob/0527ca7156a524d256101bb310a9f970f63078ad/LICENSE
-const ESCAPE_LOOKUP: { [match: string]: string } = {
-  "&": "\\u0026",
-  ">": "\\u003e",
-  "<": "\\u003c",
-  "\u2028": "\\u2028",
-  "\u2029": "\\u2029",
-};
-
-const ESCAPE_REGEX = /[&><\u2028\u2029]/g;
-
-function htmlEscape(str: string): string {
-  return str.replace(ESCAPE_REGEX, (match) => ESCAPE_LOOKUP[match]);
-}