fix(static): prevent possible XSS by sanitizing output

adobe · May 3, 2019 · 97d6387 · 97d6387
1 parent 4247842
commit 97d6387
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 1 deletion.
diff --git a/package.json b/package.json
@@ -66,6 +66,7 @@
     "progress": "2.0.1",
     "request": "2.87.0",
     "request-promise-native": "1.0.7",
+    "sanitizer": "^0.1.3",
     "semver": "^6.0.0",
     "shelljs": "0.8.2",
     "snyk": "1.159.0",

diff --git a/src/openwhisk/static.js b/src/openwhisk/static.js
@@ -18,6 +18,7 @@ const postcssurl = require('postcss-url');
 const parser = require('postcss-value-parser');
 const babel = require('@babel/core');
 const ohash = require('object-hash');
+const sanitizer = require('sanitizer');
 
 const { space } = postcss.list;
 const uri = require('uri-js');
@@ -46,7 +47,7 @@ function error(message, code = 500) {
       'X-Static': 'Raw/Static',
       'Cache-Control': 'max-age=300',
     },
-    body: `${message}`,
+    body: sanitizer.escape(message),
   };
 }