fix(security): escape survey WebView payload to prevent </script> injection (ENG-1813)

[pandeymangg]

What & why

ENG-1813 — script injection via the survey WebView payload.

renderHtml embeds the survey payload directly into an inline <script>:

const options = ${JSON.stringify(options)};

JSON.stringify escapes " and \, so the classic string/backtick breakout is already prevented here — but it does not escape <. A survey field containing </script> (or <script, <!--) terminates the inline <script> at the HTML-parser level, regardless of JS string context, and injects arbitrary markup/JS into the WebView. The payload includes server/admin-authored survey content (props.survey, styling, …), so this is attacker-influenceable.

This is the React Native variant of the same ENG-1813 issue fixed on iOS (formbricks/ios#51) and Android (formbricks/android#55).

Fix

Escape < → < in the serialized payload:

const options = ${JSON.stringify(options).replace(/</g, "\\u003c")};

< only ever appears inside JSON string values (never in structural positions), and the JS engine decodes < back to < when parsing the object literal — so the payload is preserved exactly while </script> / <script / <!-- can no longer form in the script's raw text.

Chose escaping over the iOS/Android base64 approach because React Native's JS runtime has no global Buffer/btoa (would need a polyfill); the escape is dependency-free, keeps options a plain object literal (no JSON.parse needed), and fully closes the </script> vector.

Verification

• tsc --noEmit — clean.
• vitest run — 155/155 pass.
• Node check: a headline of `${alert(1)}` </script><img src=x onerror=alert(1)> produces output with no literal </script> (in fact no literal < at all) and round-trips to the exact original object.

Notes / scope

• Part of a cross-SDK sweep of the iOS survey-WebView findings. iOS: fix: harden survey webview — TLS, script injection, URL scheme, inspectable (ENG-1810/1811/1812/1813) ios#51. Android equivalent: fix(security): base64-encode survey WebView payload to prevent script injection (ENG-1813) android#55. Flutter was already safe.
• The other three checks were audited on this SDK and are already safe: TLS/MITM (relies on react-native-webview defaults — onReceivedSslError → cancel()), WebView debugging (webviewDebuggingEnabled never set; library gates it behind DEBUG), and external URL scheme (openExternalUrl already allowlists http/https).

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: bc5ef727-936b-4d34-98be-1aae524246d5

📥 Commits

Reviewing files that changed from the base of the PR and between 54b3f30 and bc4056e.

📒 Files selected for processing (1)

• packages/react-native/src/components/survey-web-view.tsx

---

Walkthrough

renderHtml now serializes survey options into optionsJson, replacing < characters with escaped Unicode sequences before embedding the JSON in the inline script. The script initializes options from this preprocessed value instead of directly embedding JSON.stringify(options).

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main security fix: escaping the survey WebView payload to prevent script injection.
Description check	✅ Passed	The description directly explains the vulnerability, the fix, and verification, all of which match the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[mattinannt]

@pandeymangg thanks for the PR :-)