Bug stored xss in message area

[munafio]

Bug stored xss in message area

[Jieyab89]

[Jieyab89]

If the system is already right, only when it parses from append input to chat it has an xss bug

[munafio]

Hi @Jieyab89 ,
I'll check this issue and fix it ASAP.
Thanks a lot for your efforts to make this package better.

[Jieyab89]

Solved, im fix xss in chat message, im create function for encoding

//create like htmlspecialchars in js
function escapeHtml(text) {
var map = {
'&': '&',
'<': '<',
'>': '>',
'"': '"',
"'": '''
};

return text.replace(/[&<>"']/g, function(m) { return map[m]; });
}

[Jieyab89]

in file code.js

[Jieyab89]

Create function htmlescape in code.js

Code :
//create like htmlspecialchars in js
function escapeHtml(text) {
var map = {
'&': '&',
'<': '<',
'>': '>',
'"': '"',
"'": '''
};

return text.replace(/[&<>"']/g, function(m) { return map[m]; });

}
after you create the function you can call it, and call the function as needed,

For example, I called the htmlescape function in the message text area. You can check this

Example :

//create like htmlspecialchars in js
function escapeHtml(text) {
var map = {
'&': '&',
'<': '<',
'>': '>',
'"': '"',
"'": '''
};

return text.replace(/[&<>"']/g, function(m) { return map[m]; });

}

// While sending a message, show this temporary message card.
function sendigCard(message, id) {
const body = escapeHtml(message);
return <div class="message-card mc-sender" data-id="+ id + "> <p>+ body + <sub><span class="far fa-clock"></span></sub></p> </div> ;
}

[Jieyab89]

Thank you munafio