[mirotalksfu] - safety improvements

app/src/Server.js

@@ -259,8 +259,8 @@ function startServer() {
         res.redirect('/');
     });
 
-    // join room
-    app.get('/join/*', (req, res) => {
+    // join room by id
+    app.get('/join/:roomId', (req, res) => {
         if (hostCfg.authenticated) {
             res.sendFile(views.room);
         } else {
@@ -268,6 +268,11 @@ function startServer() {
         }
     });
 
+    // not specified correctly the room id
+    app.get('/join/*', (req, res) => {
+        res.redirect('/');
+    });
+
     // if not allow video/audio
     app.get(['/permission'], (req, res) => {
         res.sendFile(views.permission);
@@ -872,7 +877,8 @@ function startServer() {
         socket.on('message', (dataObject) => {
             if (!roomList.has(socket.room_id)) return;
 
-            const data = checkXSS(dataObject);
+            // const data = checkXSS(dataObject);
+            const data = dataObject;
 
             log.debug('message', data);
             if (data.to_peer_id == 'all') {