Fix reflected XSS in 'style' parameter

2020-07-02 10:28:25 +02:00
parent f8563e1f2b
commit 038bfe29d6
1 changed files with 1 additions and 1 deletions
--- a/src/utils.js
+++ b/src/utils.js
@@ -43,7 +43,7 @@ module.exports.getTileUrls = (req, domains, path, format, publicUrl, aliases) =>
    queryParams.push(`key=${encodeURIComponent(req.query.key)}`);
  }
  if (req.query.style) {
-    queryParams.push(`style=${req.query.style}`);
+    queryParams.push(`style=${encodeURIComponent(req.query.style)}`);
  }
  const query = queryParams.length > 0 ? (`?${queryParams.join('&')}`) : '';