myriation/keyoxide-web
1
0
Fork 0
forked from Mirrors/keyoxide-web
Code Pull requests Activity

fix: avoid shadowing escape

Browse source
This commit is contained in:
Yarmo Mackenbach 2024-02-13 10:05:27 +01:00
parent a57d24ad6a
commit 567130f634
No known key found for this signature in database
GPG key ID: C248C28D432560ED
2 changed files with 5 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
src/routes/util.js
View file

@ -38,7 +38,7 @@ router.get('/', function (req, res) {
router.get('/profile-url', function (req, res) { router.get('/profile-url', function (req, res) {
res.render('util/profile-url', { meta: getMetaFromReq(req) }) res.render('util/profile-url', { meta: getMetaFromReq(req) })
}) })
router.get('/profile-url/:input', router.get('/profile-url/:input',
escapedParam('input'), escapedParam('input'),
function (req, res) { function (req, res) {
res.render('util/profile-url', { input: req.params.input, meta: getMetaFromReq(req) }) res.render('util/profile-url', { input: req.params.input, meta: getMetaFromReq(req) })

8
src/server/utils.js
View file

@ -156,17 +156,17 @@ export function generateProfileTheme (/** @type {Profile} */ profile) {
const reEmailLike = /(<[^\s@<>]+@[^\s@<>]+>)/ const reEmailLike = /(<[^\s@<>]+@[^\s@<>]+>)/
export function escapedParam(name) { export function escapedParam (/** @type {String} */ name) {
return param(name).customSanitizer(value => { return param(name).customSanitizer(value => {
return value.split(reEmailLike).map(token => { return value.split(reEmailLike).map(token => {
if (reEmailLike.test(token)) return token if (reEmailLike.test(token)) return token
return escape(token) return escapeString(token)
}).join('') }).join('')
}) })
} }
// Copied from https://github.com/validatorjs/validator.js/blob/b958bd7d1026a434ad3bf90064d3dcb8b775f1a9/src/lib/escape.js // Copied from https://github.com/validatorjs/validator.js/blob/b958bd7d1026a434ad3bf90064d3dcb8b775f1a9/src/lib/escapeString.js
function escape(input) { function escapeString (/** @type {String} */ input) {
return (input.replace(/&/g, '&amp;') return (input.replace(/&/g, '&amp;')
.replace(/"/g, '&quot;') .replace(/"/g, '&quot;')
.replace(/'/g, '&#x27;') .replace(/'/g, '&#x27;')