Ensure form post is escaped (#536)

* Ensure form post is escaped * Extend escaping
boxyhq · Feb 20, 2024 · 3bdee65 · 3bdee65
1 parent 29e9069
commit 3bdee65
Showing 1 changed file with 10 additions and 1 deletion.
diff --git a/lib/post.ts b/lib/post.ts
@@ -1,6 +1,15 @@
+const escapeHtml = (unsafeHtml: string) => {
+  return unsafeHtml
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&#039;");
+}
+
 const createPostForm = (postUrl: string, params: { name: string; value: string }[]) => {
   const parr = (params || []).map(({ name, value }) => {
-    return `<input type="hidden" name="${name}" value="${value}"/>`;
+    return `<input type="hidden" name="${name}" value="${escapeHtml(value)}"/>`;
   });
 
   const formElements = [