fix: uri encode template replacement to ovoid XSS

iress · Sep 22, 2023 · 8455c15 · 8455c15
1 parent f4c0e44
commit 8455c15
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/authn/pkce.index.js b/authn/pkce.index.js
@@ -362,9 +362,9 @@ function unauthorized(error, error_description, error_uri, callback) {
   </html>
   `;
 
-  page = page.replace(/%error%/g, error);
-  page = page.replace(/%error_description%/g, error_description);
-  page = page.replace(/%error_uri%/g, error_uri);
+  page = page.replace(/%error%/g, encodeURI(error).replace(/%20/g,' '));
+  page = page.replace(/%error_description%/g, encodeURI(error_description).replace(/%20/g,' '));
+  page = page.replace(/%error_uri%/g, encodeURI(error_uri));
 
   // Unauthorized access attempt. Reset token and nonce cookies
   const response = {