WIP XSS

pages/editor.js

@@ -32,7 +32,13 @@ import { getState, saveState } from '../lib/util'
 
 const removeQueryString = str => {
   const qI = str.indexOf('?')
-  return (qI >= 0 ? str.substr(0, qI) : str).replace(/<script(?:.|\s)*>(?:.|\s)*<\/script>/gi, '')
+  return (qI >= 0 ? str.substr(0, qI) : str)
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#x27;')
+    .replace(/\//g, '&#x2F;')
 }
 
 class Editor extends React.Component {