Skip to content

Commit

Permalink
Prevent injection attacks
Browse files Browse the repository at this point in the history
The previous attempt could be bypassed by clever use of
backslashes as dCRUSty demonstrated
  • Loading branch information
bbyars committed Mar 15, 2022
1 parent 8a04bd6 commit 005aac0
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion src/util/logger.js
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ function initializeLogfile (filename) {
}

function logFormat (config) {
const template = config.replace(/\$/g, '\\$') // prevent injection attacks
const template = config.replace(/\$/g, '') // prevent injection attacks
.replace(/%level/g, '${info.level}')
.replace(/%message/g, '${info.message}')
.replace(/%timestamp/g, '${info.timestamp}');
Expand Down

0 comments on commit 005aac0

Please sign in to comment.