Home Explore Help
Sign In
biheng
/
uppy
1
0
Fork 0
Files Issues 0 Pull Requests 0 Wiki
Browse Source

companion: sanitize text before adding to html

Ifedapo Olarewaju 6 years ago
parent
f77a10270c
commit
2bf0755cea
2 changed files with 11 additions and 2 deletions
Split View Show Diff Stats
  1. 2 2
      packages/@uppy/companion/src/server/controllers/callback.js
  2. 9 0
      packages/@uppy/companion/src/server/helpers/utils.js

+ 2 - 2
packages/@uppy/companion/src/server/controllers/callback.js
View File 

@@ -4,7 +4,7 @@
 
  */
 
 const tokenService = require('../helpers/jwt')
 
 const parseUrl = require('url').parse
 
-const { hasMatch } = require('../helpers/utils')
 
+const { hasMatch, sanitizeHtml } = require('../helpers/utils')
 
 const oAuthState = require('../helpers/oauth-state')
 
 const logger = require('../logger')
 
 
@@ -40,7 +40,7 @@ module.exports = function callback (req, res, next) {
 
         <head>
 
             <meta charset="utf-8" />
 
             <script>
 
-              window.opener.postMessage({token: "${uppyAuthToken}"}, "${origin}")
 
+              window.opener.postMessage({token: "${uppyAuthToken}"}, "${sanitizeHtml(origin)}")
 
               window.close()
 
             </script>
 
         </head>

+ 9 - 0
packages/@uppy/companion/src/server/helpers/utils.js
View File 

@@ -32,6 +32,15 @@ exports.jsonStringify = (data) => {
 
   })
 
 }
 
 
+/**
 
+ * Does a simple html sanitization on the passed value
 
+ *
 
+ * @param {string} text
 
+ */
 
+exports.sanitizeHtml = (text) => {
 
+  return text.replace(/<\/?[^>]+(>|$)/g, '')
 
+}
 
+
 
 /**
 
  * Gets the size and content type of a url's content
 
  *