Fix reflected XSS in 'key' parameter. Fixes #461

2020-07-02 09:30:33 +02:00
parent a5a8ae1e95
commit 10431d70d0
3 changed files with 5 additions and 5 deletions
--- a/src/serve_style.js
+++ b/src/serve_style.js
@@ -17,7 +17,7 @@ const fixUrl = (req, url, publicUrl, opt_nokey) => {
  }
  const queryParams = [];
  if (!opt_nokey && req.query.key) {
-    queryParams.unshift(`key=${req.query.key}`);
+    queryParams.unshift(`key=${encodeURIComponent(req.query.key)}`);
  }
  let query = '';
  if (queryParams.length) {