escape res.redirect() link

expressjs · Aug 3, 2012 · bac0c64 · bac0c64 · jonchurch · Apr 25, 2024
1 parent 4892305
commit bac0c64
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 1 deletion.
diff --git a/lib/response.js b/lib/response.js
@@ -621,7 +621,8 @@ res.redirect = function(url){
     },
 
     html: function(){
-      body = '<p>' + statusCodes[status] + '. Redirecting to <a href="' + url + '">' + url + '</a></p>';
+      var u = utils.escape(url);
+      body = '<p>' + statusCodes[status] + '. Redirecting to <a href="' + u + '">' + u + '</a></p>';
     },
 
     default: function(){

diff --git a/test/res.redirect.js b/test/res.redirect.js
@@ -232,6 +232,23 @@ describe('res', function(){
         done();
       })
     })
+
+    it('should escape the url', function(done){
+      var app = express();
+
+      app.use(function(req, res){
+        res.redirect('<lame>');
+      });
+
+      request(app)
+      .get('/')
+      .set('Host', 'http://example.com')
+      .set('Accept', 'text/html')
+      .end(function(err, res){
+        res.text.should.equal('<p>Moved Temporarily. Redirecting to <a href="//http://example.com/&lt;lame&gt;">//http://example.com/&lt;lame&gt;</a></p>');
+        done();
+      })
+    })
   })
 
   describe('when accepting text', function(){