Repository: louislam/uptime-kuma
File: server/model/status_page.js (JavaScript)

Code before:
    }

    /**
     * SSR for status pages
     * @param {string} indexHTML
     * @param {StatusPage} statusPage
     */
    static async renderHTML(indexHTML, statusPage) {
        const $ = cheerio.load(indexHTML);
        const description155 = statusPage.description?.substring(0, 155) ?? "";

        $("title").text(statusPage.title);
        $("meta[name=description]").attr("content", description155);

        if (statusPage.icon) {
            $("link[rel=icon]")
                .attr("href", statusPage.icon)
                .removeAttr("type");

            $("link[rel=apple-touch-icon]").remove();
        }

        const head = $("head");

        if (statusPage.googleAnalyticsTagId) {
            let escapedGoogleAnalyticsScript = jsesc(googleAnalytics.getGoogleAnalyticsScript(statusPage.googleAnalyticsTagId), {
                "isScriptContext": true
            });
            head.append($(escapedGoogleAnalyticsScript));
        }

        // OG Meta Tags
        head.append(`<meta property="og:title" content="${statusPage.title}" />`);
        head.append(`<meta property="og:description" content="${description155}" />`);

        // Preload data
        // Add jsesc, fix https://github.com/louislam/uptime-kuma/issues/2186
        const escapedJSONObject = jsesc(await StatusPage.getStatusPageData(statusPage), {
            "isScriptContext": true
        });

        const script = $(`
            <script id="preload-data" data-json="{}">
                window.preloadData = ${escapedJSONObject};
            </script>
        `);

        head.append(script);

        // manifest.json
        $("link[rel=manifest]").attr("href", `/api/status-page/${statusPage.slug}/manifest.json`);

Review comment (bug):
I think jsesc is wrongly used, as `getGoogleAnalyticsScript()` returns with <script> tag which is not purely a javascript. I will fix it 

Code after:
    }

    /**
     * SSR for status pages
     * @param {string} indexHTML
     * @param {StatusPage} statusPage
     */
    static async renderHTML(indexHTML, statusPage) {
        const $ = cheerio.load(indexHTML);
        const description155 = statusPage.description?.substring(0, 155) ?? "";

        $("title").text(statusPage.title);
        $("meta[name=description]").attr("content", description155);

        if (statusPage.icon) {
            $("link[rel=icon]")
                .attr("href", statusPage.icon)
                .removeAttr("type");

            $("link[rel=apple-touch-icon]").remove();
        }

        const head = $("head");

        if (statusPage.googleAnalyticsTagId) {
            let escapedGoogleAnalyticsScript = googleAnalytics.getGoogleAnalyticsScript(statusPage.googleAnalyticsTagId);
            head.append($(escapedGoogleAnalyticsScript));
        }

        // OG Meta Tags
        head.append(`<meta property="og:title" content="${statusPage.title}" />`);
        head.append(`<meta property="og:description" content="${description155}" />`);

        // Preload data
        // Add jsesc, fix https://github.com/louislam/uptime-kuma/issues/2186
        const escapedJSONObject = jsesc(await StatusPage.getStatusPageData(statusPage), {
            "isScriptContext": true
        });

        const script = $(`
            <script id="preload-data" data-json="{}">
                window.preloadData = ${escapedJSONObject};
            </script>
        `);

        head.append(script);

        // manifest.json
        $("link[rel=manifest]").attr("href", `/api/status-page/${statusPage.slug}/manifest.json`);

        return $.root().html();