From b357ee196cc45c63df6f6e11d76db27bb1d0192b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20B=C3=B6hmer?= <mail@jan-boehmer.de>
Date: Wed, 10 Jun 2026 23:37:57 +0200
Subject: [PATCH] Avoid usage of raw filter in javascript to minimize risk

---
 templates/projects/import_bom_map_fields.html.twig | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/templates/projects/import_bom_map_fields.html.twig b/templates/projects/import_bom_map_fields.html.twig
index ee1e23ef..b272be64 100644
--- a/templates/projects/import_bom_map_fields.html.twig
+++ b/templates/projects/import_bom_map_fields.html.twig
@@ -132,8 +132,8 @@
     <script nonce="{{ csp_nonce('script') }}">
         // Function to initialize the field mapping page
         function initializeFieldMapping() {
-            const suggestions = {{ suggested_mapping|json_encode|raw }};
-            const fieldNameMapping = {{ field_name_mapping|json_encode|raw }};
+            const suggestions = JSON.parse("{{ suggested_mapping|json_encode|escape('js')}}");
+            const fieldNameMapping = JSON.parse("{{ field_name_mapping|json_encode|escape('js') }}");
 
             Object.keys(suggestions).forEach(function(field) {
                 // Use the sanitized field name from the server-side mapping