@@ -107,13 +107,20 @@ function getDependencyScripts(esmVersion: string, esmFallbackVersion: string, da
107107 </ script > ` ;
108108}
109109
110+ function escapeScriptContent ( code : string ) : string {
111+ return code
112+ . replace ( / < \/ s c r i p t / gi, "<\\/script" )
113+ . replace ( / < ! - - / g, "<\\!--" )
114+ . replace ( / - - > / g, "--\\>" ) ;
115+ }
116+
110117function getSandboxDocument ( artifact : DashboardArtifact , baseUrl : string , dashboardUrl : string , initialTheme : "light" | "dark" , showControls : boolean , initialChatOpen : boolean ) : string {
111- const sourceCode = artifact . runtimeCodegen . uiRuntimeSourceCode ;
118+ const sourceCode = escapeScriptContent ( artifact . runtimeCodegen . uiRuntimeSourceCode ) ;
112119 const darkClass = initialTheme === "dark" ? "dark" : "" ;
113120 const esmVersion = packageJson . version ;
114121 const esmFallbackVersion = "2.8.71" ;
115122 const devScriptSrc = isDev ? ` ${ dashboardUrl } ` : '' ;
116- const devConnectSrc = isDev ? ` ${ dashboardUrl } http://127.0.0.1:7322 ` : '' ;
123+ const devConnectSrc = isDev ? ` ${ dashboardUrl } ` : '' ;
117124
118125 return html `<!doctype html>
119126< html class ="${ darkClass } ">
@@ -445,7 +452,9 @@ export const DashboardSandboxHost = memo(function DashboardSandboxHost({
445452 const { resolvedTheme } = useTheme ( ) ;
446453
447454 const baseUrl = useMemo ( ( ) => {
448- return getPublicEnvVar ( "NEXT_PUBLIC_STACK_API_URL" ) ?? 'http://localhost:8102' ;
455+ const url = getPublicEnvVar ( "NEXT_PUBLIC_STACK_API_URL" ) ;
456+ if ( ! url ) throw new Error ( "NEXT_PUBLIC_STACK_API_URL is not set" ) ;
457+ return url ;
449458 } , [ ] ) ;
450459
451460 const dashboardUrl = useMemo ( ( ) => {
0 commit comments