Problem
The virtual:funstack/entries, client-init, and build-entry loaders in packages/static/src/plugin/index.ts splice resolved paths into generated code as raw string literals:
return `export { default } from "${resolvedEntriesModule}";`;
// ...
`import Root from "${root}";`,
`import "${resolvedClientInitEntry}";`,normalizePath converts backslashes to forward slashes, but a path containing a " (or other characters needing escaping in a JS string literal) still produces a syntax error — or in the worst case, injected code — in the generated module. The glob pattern in the fsRoutes branch is already correctly embedded with JSON.stringify; the path interpolations should be too.
Suggested fix
Wrap every interpolated path with JSON.stringify(...) when emitting the import/export statements.
Found during a framework audit.
Problem
The
virtual:funstack/entries,client-init, andbuild-entryloaders inpackages/static/src/plugin/index.tssplice resolved paths into generated code as raw string literals:normalizePathconverts backslashes to forward slashes, but a path containing a"(or other characters needing escaping in a JS string literal) still produces a syntax error — or in the worst case, injected code — in the generated module. The glob pattern in the fsRoutes branch is already correctly embedded withJSON.stringify; the path interpolations should be too.Suggested fix
Wrap every interpolated path with
JSON.stringify(...)when emitting the import/export statements.Found during a framework audit.