diff --git a/app/src/Server.js b/app/src/Server.js index c6caeae9..4589a03b 100644 --- a/app/src/Server.js +++ b/app/src/Server.js @@ -217,7 +217,7 @@ function startServer() { if (hostCfg.protected == true) { let ip = getIP(req); log.debug(`Request login to host from: ${ip}`, req.query); - const { username, password } = req.query; + const { username, password } = checkXSS(req.query); if (username == hostCfg.username && password == hostCfg.password) { hostCfg.authenticated = true; authHost = new Host(ip, true); @@ -253,7 +253,7 @@ function startServer() { if (hostCfg.authenticated && Object.keys(req.query).length > 0) { log.debug('Direct Join', req.query); // http://localhost:3010/join?room=test&password=0&name=mirotalksfu&audio=1&video=1&screen=1¬ify=1 - const { room, password, name, audio, video, screen, notify } = req.query; + const { room, password, name, audio, video, screen, notify } = checkXSS(req.query); if (room && password && name && audio && video && screen && notify) { return res.sendFile(views.room); } diff --git a/app/src/XSS.js b/app/src/XSS.js index 1f026ce2..8d1df82c 100644 --- a/app/src/XSS.js +++ b/app/src/XSS.js @@ -10,7 +10,7 @@ const checkXSS = (dataObject) => { log.debug('Sanitization done'); return JSON.parse(data); } - return dataObject; + return xss(dataObject); }; module.exports = checkXSS; diff --git a/public/views/login.html b/public/views/login.html index 31b3a215..2de03e23 100644 --- a/public/views/login.html +++ b/public/views/login.html @@ -51,6 +51,9 @@ + + +
@@ -125,8 +128,8 @@ }; function login() { - let username = document.getElementById('username').value; - let password = document.getElementById('password').value; + const username = filterXSS(document.getElementById('username').value); + const password = filterXSS(document.getElementById('password').value); if (username && password) { window.location.href = `/login?username=${username}&password=${password}`; diff --git a/public/views/permission.html b/public/views/permission.html index 35131e30..6751aa50 100755 --- a/public/views/permission.html +++ b/public/views/permission.html @@ -42,6 +42,9 @@ + + +
@@ -72,8 +75,8 @@