fix: escape error.message on login failure #3695
Conversation
Codecov Report
@@ Coverage Diff @@
## main #3695 +/- ##
==========================================
+ Coverage 60.22% 61.55% +1.33%
==========================================
Files 35 35
Lines 1810 1813 +3
Branches 365 365
==========================================
+ Hits 1090 1116 +26
+ Misses 604 588 -16
+ Partials 116 109 -7
Continue to review full report at Codecov.
|
e5c705c to
2e76ae1
Compare
2e76ae1 to
beaf3ce
Compare
157abcf to
f7e445d
Compare
| **/ | ||
| export function escapeHtml(unsafe: string): string { | ||
| return unsafe | ||
| .replace(/&/g, "&") |
There was a problem hiding this comment.
seems kinda unfortunate that there isn't a built-in function for doing this? I'm always wary of escaping things incorrectly, but this seems reasonable enough
There was a problem hiding this comment.
Well, it is built-in but:
Although
escape()is not strictly deprecated (as in "removed from the Web standards"), it is defined in Annex B of the ECMA-262 standard, whose introduction states:
Programmers should not use or assume the existence of these features and behaviors when writing new ECMAScript code
This can be used to escape any special characters in a string with HTML before sending from the server back to the client. This is important to prevent a cross-site scripting attack.
f7e445d to
c0e123a
Compare
This PR fixes a security issue by sanitizing the
error.messagebefore sending it back to the client on a login failure.Changes
escapeHtml+ testserror.messagebefore sending to client on login failureChecklist
Fixes #3382