XSS Vulnerability in Link/Post Comments

[xeroday-net]

This was opened and closed before, but the vulnerability still exists. For anyone looking to fix it, the sanitize-html library seems like the simplest way to go.

Just run npm install sanitize-html --save and follow the guidelines below:

1. Update package.json to include "sanitize-html": "1.14.1"
2. Update the view.on('post') function in routes.views.link and routes.views.post like this:

const sanitizer = require('sanitize-html');

...

view.on('post', {action: 'create-comment'}, function (next) {
    // Handle form
    const newLinkComment = new LinkComment.model({link: locals.link.id, author: locals.user.id,});
    const updater = newLinkComment.getUpdateHandler(req, res, {
        errorMessage: 'There was an error creating your comment:',
    });
    const comment = sanitizer(req.body.content, {
        allowedTags: [ 'b', 'i', 'em', 'strong', 'a' ],
        allowedAttributes: { 'a': [ 'href' ], },
    });

    if (req.user.isVerified) {
        if (comment.length) {
            updater.process(req.body, {
                flashErrors: true,
                logErrors: true,
                fields: 'content',
            }, function (err) {
                if (err) {
                    locals.validationErrors = err.errors;
                } else {
                    req.flash('success', 'Your comment has been added successfully.');
                    return res.redirect('/links/link/' + locals.link.slug);
                }
                next();
            });
        } else {
            if (req.body.content.length) {
                req.flash('error', 'Either you entered a disallowed symbol or you were being shady...not cool, bro!');
            } else {
                req.flash('error', 'You cannot post a blank comment.');
            }
            return res.redirect('/links/link/' + locals.link.slug);
        }
    } else {
        req.flash('error', 'You cannot comment until you confirm your registration.');
        return res.redirect('/links/link/' + locals.link.slug);
    }
});

Bear in mind that I have setup email validation and require it to comment which explains a couple extra lines of code. This also still allows URLs in the comments, so mind what your users are entering.