Merge pull request #74 from thomasdbock/thomasdbock-prevent-xss

Very basic XSS prevention
Widen · Sep 7, 2020 · ec2ec47 · ec2ec47
2 parents 84ceb51 + 794cd30
commit ec2ec47
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/authn/openid.index.js b/authn/openid.index.js
@@ -294,9 +294,9 @@ function unauthorized(error, error_description, error_uri, callback) {
   </html>
   `;
 
-  page = page.replace(/%error%/g, error);
-  page = page.replace(/%error_description%/g, error_description);
-  page = page.replace(/%error_uri%/g, error_uri);
+  page = page.replace(/%error%/g, encodeURI(error));
+  page = page.replace(/%error_description%/g, encodeURI(error_description));
+  page = page.replace(/%error_uri%/g, encodeURI(error_uri));
 
   // Unauthorized access attempt. Reset token and nonce cookies
   const response = {