feat: add escapeHtml option to XssValidator #377
Conversation
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
|
Hey @Morgbn Great to have you here! Thanks for the pull request. I will review it in upcoming days :) |
| import { defineEventHandler, createError, getQuery, readBody, getRouteRules } from '#imports' | ||
|
|
||
| export default defineEventHandler(async (event) => { | ||
| const { security } = getRouteRules(event) | ||
|
|
||
| if (security?.xssValidator) { | ||
| const xssValidator = new FilterXSS(security.xssValidator) | ||
| const filterOpt: IFilterXSSOptions = { ...security.xssValidator, escapeHtml: undefined } |
There was a problem hiding this comment.
question: What if user passes escapeHtml in xssValidator? Wouldn't this line overwrite it automatically to undefined?
There was a problem hiding this comment.
Hey @Baroshem !
Yes, it removes escapeHtml: boolean that not compatible with escapeHtml?: EscapeHandler (def)
If security.xssValidator.escapeHtml is false, the escapeHtml is set as a function that returns its input directly (which doesn't escapes ">" & "<")
if it's true or undefined, the default function will be used by js-xss (which escapes ">" & "<")
There was a problem hiding this comment.
I see, makes sense!
Thanks for clarification :)
resolves #206
Types of changes
Description
js-xss has
escapeHtmloption, by default<is replaced by<and>by>This pull request allows dev to easily disable this feature
Checklist:
To test
Before this fail:
Now, if
xssValidator.escapeHtmlis set to false it works