fixes xss vulnerability in universal example, #1855 (#1856)

brigand · timdorr · commit 47a3fa882a30 · 2016-07-19T11:32:15.000-04:00
diff --git a/examples/universal/server/server.js b/examples/universal/server/server.js
@@ -66,7 +66,7 @@ function renderFullPage(html, preloadedState) {
       <body>
         <div id="app">${html}</div>
         <script>
-          window.__PRELOADED_STATE__ = ${JSON.stringify(preloadedState)}
+          window.__PRELOADED_STATE__ = ${JSON.stringify(preloadedState).replace(/</g, '\\x3c')}
         </script>
         <script src="/static/bundle.js"></script>
       </body>
