Merge pull request #38 from iress/DP-803

URI encode template replacement to avoid XSS
iress · Oct 2, 2023 · 1d9f87a · 1d9f87a
2 parents 0d6d923 + 185bfdb
commit 1d9f87a
Show file tree

Hide file tree

Showing 4 changed files with 474 additions and 94 deletions.
diff --git a/authn/openid.index.js b/authn/openid.index.js
@@ -7,6 +7,8 @@ const auth = require('./auth.js');
 const nonce = require('./nonce.js');
 const axios = require('axios');
 const url = require('url');
+const entities = require('html-entities');
+
 var discoveryDocument;
 var jwks;
 var config;
@@ -349,9 +351,9 @@ function unauthorized(error, error_description, error_uri, callback) {
 </body>
 </html>`;
 
-  page = page.replace(/%error%/g, encodeURI(error).replace(/%20/g,' '));
-  page = page.replace(/%error_description%/g, encodeURI(error_description).replace(/%20/g,' '));
-  page = page.replace(/%error_uri%/g, encodeURI(error_uri));
+  page = page.replace(/%error%/g, entities.encode(error));
+  page = page.replace(/%error_description%/g, entities.encode(error_description));
+  page = page.replace(/%error_uri%/g, entities.encode(error_uri));
 
   // Unauthorized access attempt. Reset token and nonce cookies
   const response = {

diff --git a/authn/pkce.index.js b/authn/pkce.index.js
@@ -8,6 +8,8 @@ const codeChallenge = require('./code-challenge.js');
 const cfg = require('./config.js');
 const axios = require('axios');
 const url = require('url');
+const entities = require('html-entities');
+
 var discoveryDocument;
 var jwks;
 var config;
@@ -373,9 +375,9 @@ function unauthorized(error, error_description, error_uri, callback) {
 </body>
 </html>`;
 
-  page = page.replace(/%error%/g, error);
-  page = page.replace(/%error_description%/g, error_description);
-  page = page.replace(/%error_uri%/g, error_uri);
+  page = page.replace(/%error%/g, entities.encode(error));
+  page = page.replace(/%error_description%/g, entities.encode(error_description));
+  page = page.replace(/%error_uri%/g, entities.encode(error_uri));
 
   // Unauthorized access attempt. Reset token and nonce cookies
   const response = {