HTML instead of URI encoding for unauthorized body

iress · Sep 25, 2023 · c5fc6c4 · c5fc6c4
1 parent 8455c15
commit c5fc6c4
Show file tree

Hide file tree

Showing 4 changed files with 470 additions and 94 deletions.
diff --git a/authn/openid.index.js b/authn/openid.index.js
@@ -7,6 +7,8 @@ const auth = require('./auth.js');
 const nonce = require('./nonce.js');
 const axios = require('axios');
 const url = require('url');
+const entities = require('entities');
+
 var discoveryDocument;
 var jwks;
 var config;
@@ -335,9 +337,9 @@ function unauthorized(error, error_description, error_uri, callback) {
   </html>
   `;
 
-  page = page.replace(/%error%/g, encodeURI(error).replace(/%20/g,' '));
-  page = page.replace(/%error_description%/g, encodeURI(error_description).replace(/%20/g,' '));
-  page = page.replace(/%error_uri%/g, encodeURI(error_uri));
+  page = page.replace(/%error%/g, entities.encodeHTML(error));
+  page = page.replace(/%error_description%/g, entities.encodeHTML(error_description));
+  page = page.replace(/%error_uri%/g, entities.encodeHTML(error_uri));
 
   // Unauthorized access attempt. Reset token and nonce cookies
   const response = {

diff --git a/authn/pkce.index.js b/authn/pkce.index.js
@@ -8,6 +8,8 @@ const codeChallenge = require('./code-challenge.js');
 const cfg = require('./config.js');
 const axios = require('axios');
 const url = require('url');
+const entities = require('entities');
+
 var discoveryDocument;
 var jwks;
 var config;
@@ -362,9 +364,9 @@ function unauthorized(error, error_description, error_uri, callback) {
   </html>
   `;
 
-  page = page.replace(/%error%/g, encodeURI(error).replace(/%20/g,' '));
-  page = page.replace(/%error_description%/g, encodeURI(error_description).replace(/%20/g,' '));
-  page = page.replace(/%error_uri%/g, encodeURI(error_uri));
+  page = page.replace(/%error%/g, entities.encodeHTML(error));
+  page = page.replace(/%error_description%/g, entities.encodeHTML(error_description));
+  page = page.replace(/%error_uri%/g, entities.encodeHTML(error_uri));
 
   // Unauthorized access attempt. Reset token and nonce cookies
   const response = {