prevent unsafe replacements of preloaded data etc

src/middleware.ts

@@ -360,11 +360,11 @@ function get_page_handler(App: Component, routes: RouteObject[], store_getter: (
 			}
 
 			const page = template()
-				.replace('%sapper.base%', `<base href="${req.baseUrl}/">`)
-				.replace('%sapper.scripts%', `<script>${inline_script}</script>${scripts}`)
-				.replace('%sapper.html%', html)
-				.replace('%sapper.head%', `<noscript id='sapper-head-start'></noscript>${head}<noscript id='sapper-head-end'></noscript>`)
-				.replace('%sapper.styles%', (css && css.code ? `<style>${css.code}</style>` : ''));
+				.replace('%sapper.base%', () => `<base href="${req.baseUrl}/">`)
+				.replace('%sapper.scripts%', () => `<script>${inline_script}</script>${scripts}`)
+				.replace('%sapper.html%', () => html)
+				.replace('%sapper.head%', () => `<noscript id='sapper-head-start'></noscript>${head}<noscript id='sapper-head-end'></noscript>`)
+				.replace('%sapper.styles%', () => (css && css.code ? `<style>${css.code}</style>` : ''));
 
 			res.statusCode = status;
 			res.end(page);

test/app/routes/unsafe-replacement.html

@@ -0,0 +1,9 @@
+$&
+
+<script>
+	export default {
+		preload() {
+			return '$&';
+		}
+	};
+</script>

test/common/test.js

@@ -619,6 +619,16 @@ function run({ mode, basepath = '' }) {
 						assert.equal(name, 'BODY');
 					});
 			});
+
+			it('replaces %sapper.xxx% tags safely', () => {
+				return nightmare
+					.goto(`${base}/unsafe-replacement`)
+					.init()
+					.page.html()
+					.then(html => {
+						assert.equal(html.indexOf('%sapper'), -1);
+					});
+			});
 		});
 
 		describe('headers', () => {