OCram85/code-server
Archived
1
0
Fork 0
Code Pull Requests 2 Activity

feat: add escapeHtml function

Browse Source 
This can be used to escape any special characters in a string with HTML before
sending from the server back to the client. This is important to prevent a
cross-site scripting attack.
This commit is contained in:
Joe Previte
2021-06-29 15:28:44 -07:00
parent faa896c12c
commit c505fc45a8
4 changed files with 67 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/node/routes/login.ts
View File

@ -4,7 +4,7 @@ import { RateLimiter as Limiter } from "limiter"
import * as path from "path"
import { rootPath } from "../constants"
import { authenticated, getCookieDomain, redirect, replaceTemplates } from "../http"
import { getPasswordMethod, handlePasswordValidation, humanPath, sanitizeString } from "../util"
import { getPasswordMethod, handlePasswordValidation, humanPath, sanitizeString, escapeHtml } from "../util"
export enum Cookie {
Key = "key",
@ -36,6 +36,7 @@ const getRoot = async (req: Request, error?: Error): Promise<string> => {
} else if (req.args.usingEnvHashedPassword) {
passwordMsg = "Password was set from $HASHED_PASSWORD."
}
return replaceTemplates(
req,
content
@ -111,6 +112,8 @@ router.post("/", async (req, res) => {
throw new Error("Incorrect password")
} catch (error) {
res.send(await getRoot(req, error))
const html = await getRoot(req, error)
const escapedHtml = escapeHtml(html)
res.send(escapedHtml)
}
})