WIP XSS

7 years ago · a998ccf139
parent cf72b87f08
commit a998ccf139
1 changed files with 7 additions and 1 deletions
--- a/pages/editor.js
+++ b/pages/editor.js
@ -32,7 +32,13 @@ import { getState, saveState } from '../lib/util'

 const removeQueryString = str => {
  const qI = str.indexOf('?')
-  return (qI >= 0 ? str.substr(0, qI) : str).replace(/<script(?:.|\s)*>(?:.|\s)*<\/script>/gi, '')
+  return (qI >= 0 ? str.substr(0, qI) : str)
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#x27;')
+    .replace(/\//g, '&#x2F;')
 }

 class Editor extends React.Component {