[andife]

Summary: Serialize generated CycloneDX JSON with the context-aware Jinja tojson filter, preventing model metadata from terminating the surrounding script element. Adds a script-terminator regression test. Testing: targeted web-controller tests and the full test suite pass.

[drk-ram]

I checked 5ed6279 and traced both export strings through the result page and the existing download helper.

All three web-controller tests pass. Replacing tojson with safe independently for each constant makes the contributed regression fail.

I checked four payloads against both constants, including </script><script>alert(1)</script>, mixed-case terminators, comment prefixes, quotes, and Unicode separators.

The rendered expressions contain no literal opening angle brackets. Decoding them reproduces the saved 1.6 and 1.7 documents exactly.

The values now remain strings, which downloadJSON already supports without double-encoding downloads.

No blocker in these two template changes.