fix Cross-site scripting (XSS) vulnerability

reference: https://gist.github.com/lirantal/52debd25284726fcc2eaed9c7512975c
beenotung · May 2, 2023 · f7a0062 · f7a0062
1 parent bc676c1
commit f7a0062
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/server.js b/server.js
@@ -130,9 +130,14 @@ async function main() {
             res.write(templatePart2)
             for (let file of files) {
               let href = `${req.url}/${file}`.replace(/^\/\//, '/')
+              href = encodeURI(href)
+              let text = file
+                .replace(/&/g, '&amp')
+                .replace(/</g, '&lt')
+                .replace(/>/g, '&gt')
               let stat = fs.statSync(path.join(dir, file))
               let type = stat.isDirectory() ? 'D' : 'F'
-              res.write(`[${type}] <a href="${href}">${file}</a><br>`)
+              res.write(`[${type}] <a href="${href}">${text}</a><br>`)
             }
             if (files.length === 0) {
               res.write(`[empty directory]`)