Closed
Description
I tested my restify server with this:
https://localhost:3000/no5_such3_file7.pl?%22%3E%3Cscript%3Ealert(73541);%3C/script%3E
The returned data contains "<script>alert(73541);</script>" which some browsers will execute.
Simple solution is to change the ResourceNotFoundError at the end of the Router.prototype.find to something like this:
callback(new ResourceNotFoundError('%s does not exist', url.parse(req.url).pathname));
Metadata
Metadata
Assignees
Labels
No labels