From 0dd1c07b661cca51482eae3b219699e443473b2f Mon Sep 17 00:00:00 2001
From: Lan Tian <xuyh0120@outlook.com>
Date: Mon, 1 Jul 2024 21:16:43 -0700
Subject: [PATCH] frontend: disable escaping of special HTML chars for BGPMap
 graph

---
 frontend/bgpmap_graph.go | 9 +++++++--
 frontend/bgpmap_test.go  | 2 +-
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/frontend/bgpmap_graph.go b/frontend/bgpmap_graph.go
index 03e5c46..f3ff7cd 100644
--- a/frontend/bgpmap_graph.go
+++ b/frontend/bgpmap_graph.go
@@ -1,6 +1,7 @@
 package main
 
 import (
+	"bytes"
 	"encoding/json"
 	"fmt"
 	"strings"
@@ -69,11 +70,15 @@ func (graph *RouteGraph) attrsToString(attrs RouteAttrs) string {
 }
 
 func (graph *RouteGraph) escape(s string) string {
-	result, err := json.Marshal(s)
+	buffer := &bytes.Buffer{}
+	encoder := json.NewEncoder(buffer)
+	encoder.SetEscapeHTML(false)
+	err := encoder.Encode(s)
+
 	if err != nil {
 		return err.Error()
 	} else {
-		return string(result)
+		return string(buffer.Bytes())
 	}
 }
 
diff --git a/frontend/bgpmap_test.go b/frontend/bgpmap_test.go
index 3450410..5c15c6f 100644
--- a/frontend/bgpmap_test.go
+++ b/frontend/bgpmap_test.go
@@ -33,7 +33,7 @@ func TestBirdRouteToGraphvizXSS(t *testing.T) {
 		fakeResult,
 	}, fakeResult)
 
-	if strings.Contains(result, "<script>") {
+	if strings.Contains(result, fakeResult) {
 		t.Errorf("XSS injection succeeded: %s", result)
 	}
 }