From b041842e4a898453d2f6d615af48dff8796484fa Mon Sep 17 00:00:00 2001
From: Baptiste Arnaud <baptiste.arnaud95@gmail.com>
Date: Wed, 28 May 2025 17:01:24 +0200
Subject: [PATCH] =?UTF-8?q?=F0=9F=90=9B=20(engine)=20Sanitize=20variable?=
 =?UTF-8?q?=20value=20before=20saving=20to=20avoid=20db=20insert=20failure?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../src/updateVariablesInSession.ts           | 22 +++++++++++++++++--
 1 file changed, 20 insertions(+), 2 deletions(-)

diff --git a/packages/bot-engine/src/updateVariablesInSession.ts b/packages/bot-engine/src/updateVariablesInSession.ts
index 1e91d5c31..f61a712bc 100644
--- a/packages/bot-engine/src/updateVariablesInSession.ts
+++ b/packages/bot-engine/src/updateVariablesInSession.ts
@@ -71,8 +71,10 @@ const updateTypebotVariables = ({
   const serializedNewVariables = newVariables.map((variable) => ({
     ...variable,
     value: Array.isArray(variable.value)
-      ? variable.value.map(safeStringify)
-      : safeStringify(variable.value),
+      ? variable.value.map((value) =>
+          sanitizeNewVariableValue(safeStringify(value)),
+        )
+      : sanitizeNewVariableValue(safeStringify(variable.value)),
   }));
 
   let setVariableHistoryIndex = state.currentSetVariableHistoryIndex ?? 0;
@@ -106,3 +108,19 @@ const updateTypebotVariables = ({
     setVariableHistoryIndex,
   };
 };
+
+const sanitizeNewVariableValue = (value: string | null): string | null =>
+  value ? sanitizeString(value) : null;
+
+export const sanitizeString = (input: string): string => {
+  // 1. Replace unpaired surrogate halves with �
+  let output = input.replace(
+    /([\uD800-\uDBFF](?![\uDC00-\uDFFF]))|((?<![\uD800-\uDBFF])[\uDC00-\uDFFF])/g,
+    "�",
+  );
+
+  // 2. Escape lone backslashes that could break downstream JSON parsing
+  output = output.replace(/\\(?![\\ntbrf"'u])/g, "\\\\");
+
+  return output;
+};