From 234d38784683d31dfbceed8e4abc8011e6ab2853 Mon Sep 17 00:00:00 2001 From: vagdotdev Date: Tue, 30 Jun 2026 11:51:25 +0530 Subject: [PATCH] fix: escape admin file page values --- lib/utils/escape-html.ts | 8 +++++++ routes/admin/files/get.ts | 24 +++++++++++-------- routes/admin/files/list.ts | 3 ++- tests/routes/admin-files-page.test.ts | 33 +++++++++++++++++++++++++++ 4 files changed, 57 insertions(+), 11 deletions(-) create mode 100644 lib/utils/escape-html.ts diff --git a/lib/utils/escape-html.ts b/lib/utils/escape-html.ts new file mode 100644 index 0000000..8a82233 --- /dev/null +++ b/lib/utils/escape-html.ts @@ -0,0 +1,8 @@ +export function escapeHtml(value: string): string { + return value + .replace(/&/g, "&") + .replace(//g, ">") + .replace(/"/g, """) + .replace(/'/g, "'") +} diff --git a/routes/admin/files/get.ts b/routes/admin/files/get.ts index 046d202..1ca3a2b 100644 --- a/routes/admin/files/get.ts +++ b/routes/admin/files/get.ts @@ -1,4 +1,5 @@ import { withRouteSpec } from "lib/middleware/with-winter-spec" +import { escapeHtml } from "lib/utils/escape-html" import { z } from "zod" export default withRouteSpec({ @@ -15,10 +16,16 @@ export default withRouteSpec({ return new Response("File not found", { status: 404 }) } + const encodedPath = file.file_path + .split("/") + .map(encodeURIComponent) + .join("/") + const encodedPathWithoutLeadingSlash = encodedPath.replace(/^\/+/, "") + return new Response( ` - File Details - ${file.file_path} + File Details - ${escapeHtml(file.file_path)}