diff --git a/src/middleware.ts b/src/middleware.ts
index 44c2b5089..79e495052 100644
--- a/src/middleware.ts
+++ b/src/middleware.ts
@@ -360,11 +360,11 @@ function get_page_handler(App: Component, routes: RouteObject[], store_getter: (
}
const page = template()
- .replace('%sapper.base%', ``)
- .replace('%sapper.scripts%', `${scripts}`)
- .replace('%sapper.html%', html)
- .replace('%sapper.head%', `${head}`)
- .replace('%sapper.styles%', (css && css.code ? `` : ''));
+ .replace('%sapper.base%', () => ``)
+ .replace('%sapper.scripts%', () => `${scripts}`)
+ .replace('%sapper.html%', () => html)
+ .replace('%sapper.head%', () => `${head}`)
+ .replace('%sapper.styles%', () => (css && css.code ? `` : ''));
res.statusCode = status;
res.end(page);
diff --git a/test/app/routes/unsafe-replacement.html b/test/app/routes/unsafe-replacement.html
new file mode 100644
index 000000000..98c654fec
--- /dev/null
+++ b/test/app/routes/unsafe-replacement.html
@@ -0,0 +1,9 @@
+$&
+
+
\ No newline at end of file
diff --git a/test/common/test.js b/test/common/test.js
index 79751e71c..84fb55e9e 100644
--- a/test/common/test.js
+++ b/test/common/test.js
@@ -619,6 +619,16 @@ function run({ mode, basepath = '' }) {
assert.equal(name, 'BODY');
});
});
+
+ it('replaces %sapper.xxx% tags safely', () => {
+ return nightmare
+ .goto(`${base}/unsafe-replacement`)
+ .init()
+ .page.html()
+ .then(html => {
+ assert.equal(html.indexOf('%sapper'), -1);
+ });
+ });
});
describe('headers', () => {