Fix dev.openvibe.tools rendering raw JS: escape </script> in a string

OP OpenVibers committed 18 Aug 2026 · eba32c0e57 · 1 file, +1 −1

The escape tool's placeholder was the literal string
'<script>alert("hello")</script>'. The HTML parser doesn't understand JS
string literals — it ends a script block at the first '</script>' it
sees, wherever it appears. So the inline block opening at line 140 was
terminated at line 160 instead of 434, and the remaining ~274 lines of
the tool registry rendered on the page as text, starting mid-literal at
",m:['HTML Enc'".

Write it as '<\/script>': identical string value at runtime, but the
parser no longer sees a closing tag.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Xw6Sf5zzSALw8m93XNu5JE

Changes

ddiff --git a/apps/gateway/public/dev.html b/apps/gateway/public/dev.html
iindex 960dbf6..35b6b79 100644
---- a/apps/gateway/public/dev.html
++++ b/apps/gateway/public/dev.html
@@@ -157,7 +157,7 @@ jwt:{n:'OpenVibeJWT',i:'fa-key',c:'enc',d:'JWT decoder \u2014 header, payload &
  uuid:{n:'OpenVibeUUID',i:'fa-fingerprint',c:'enc',d:'UUID v4 generator & validator',p:'',m:['Generate','Bulk 10','Bulk 100','Validate']},
  hash:{n:'OpenVibeHash',i:'fa-hashtag',c:'enc',d:'SHA-256, SHA-1 & SHA-512 hash generator',p:'Hello, World!',m:['SHA-256','SHA-1','SHA-512']},
  hex:{n:'OpenVibeHex',i:'fa-barcode',c:'enc',d:'Hex encoder / decoder',p:'Hello',m:['To Hex','From Hex']},
--escape:{n:'OpenVibeEscape',i:'fa-shield-halved',c:'enc',d:'HTML, JS & URL escape / unescape',p:'<script>alert("hello")</script>',m:['HTML Enc','HTML Dec','JS Esc','JS Unesc','URL Enc','URL Dec']},
++escape:{n:'OpenVibeEscape',i:'fa-shield-halved',c:'enc',d:'HTML, JS & URL escape / unescape',p:'<script>alert("hello")<\/script>',m:['HTML Enc','HTML Dec','JS Esc','JS Unesc','URL Enc','URL Dec']},
  timestamp:{n:'OpenVibeTimestamp',i:'fa-clock',c:'time',d:'Unix timestamp \u2194 date converter',p:'',m:['Now','To Date','To Unix']},
  cron:{n:'OpenVibeCron',i:'fa-calendar-check',c:'time',d:'Cron expression parser & next runs',p:'*/15 9-17 * * 1-5',m:['Parse']},
  beautify:{n:'OpenVibeBeautify',i:'fa-wand-magic-sparkles',c:'qual',d:'Beautify JS, CSS, HTML & JSON',p:'{"a":1,"b":[2,3],"c":{"d":true}}',m:['JSON','HTML','CSS']},

diff --git a/apps/gateway/public/dev.html b/apps/gateway/public/dev.html

index 960dbf6..35b6b79 100644

--- a/apps/gateway/public/dev.html

+++ b/apps/gateway/public/dev.html

@@ -157,7 +157,7 @@ jwt:{n:'OpenVibeJWT',i:'fa-key',c:'enc',d:'JWT decoder \u2014 header, payload &

uuid:{n:'OpenVibeUUID',i:'fa-fingerprint',c:'enc',d:'UUID v4 generator & validator',p:'',m:['Generate','Bulk 10','Bulk 100','Validate']},

hash:{n:'OpenVibeHash',i:'fa-hashtag',c:'enc',d:'SHA-256, SHA-1 & SHA-512 hash generator',p:'Hello, World!',m:['SHA-256','SHA-1','SHA-512']},

hex:{n:'OpenVibeHex',i:'fa-barcode',c:'enc',d:'Hex encoder / decoder',p:'Hello',m:['To Hex','From Hex']},

-escape:{n:'OpenVibeEscape',i:'fa-shield-halved',c:'enc',d:'HTML, JS & URL escape / unescape',p:'<script>alert("hello")</script>',m:['HTML Enc','HTML Dec','JS Esc','JS Unesc','URL Enc','URL Dec']},

+escape:{n:'OpenVibeEscape',i:'fa-shield-halved',c:'enc',d:'HTML, JS & URL escape / unescape',p:'<script>alert("hello")<\/script>',m:['HTML Enc','HTML Dec','JS Esc','JS Unesc','URL Enc','URL Dec']},

timestamp:{n:'OpenVibeTimestamp',i:'fa-clock',c:'time',d:'Unix timestamp \u2194 date converter',p:'',m:['Now','To Date','To Unix']},

cron:{n:'OpenVibeCron',i:'fa-calendar-check',c:'time',d:'Cron expression parser & next runs',p:'*/15 9-17 * * 1-5',m:['Parse']},

beautify:{n:'OpenVibeBeautify',i:'fa-wand-magic-sparkles',c:'qual',d:'Beautify JS, CSS, HTML & JSON',p:'{"a":1,"b":[2,3],"c":{"d":true}}',m:['JSON','HTML','CSS']},