(value: unknown)
| 62 | * (`<`, `>`, `&`) so an attacker-controlled `error` field can't break out. |
| 63 | */ |
| 64 | const serializeForScript = (value: unknown): string => |
| 65 | JSON.stringify(value) |
| 66 | .replaceAll("<", "\\u003c") |
| 67 | .replaceAll(">", "\\u003e") |
| 68 | .replaceAll("&", "\\u0026"); |
| 69 | |
| 70 | /** |
| 71 | * Render the HTML page that the OAuth redirect returns. The page is |