Security Fix for Stored-XSS on "HiChat" - huntr.dev

package.json

@@ -4,11 +4,13 @@
     "version": "0.4.0",
     "main": "server.js",
     "dependencies": {
+        "dompurify": "^2.0.15",
         "express": "3.4.x",
-        "socket.io": "0.9.x"
+        "sanitize-html": "^1.27.4",
+        "socket.io": "^1.0.6"
     },
     "engines": {
         "node": "0.10.x",
         "npm": "1.2.x"
     }
-}
+}

server.js

@@ -2,6 +2,7 @@ var express = require('express'),
     app = express(),
     server = require('http').createServer(app),
     io = require('socket.io').listen(server),
+    sanitizehtml = require('./www/scripts/sanitizehtml.js')
     users = [];
 //specify the html we will use
 app.use('/', express.static(__dirname + '/www'));
@@ -18,26 +19,26 @@ io.sockets.on('connection', function(socket) {
             socket.emit('nickExisted');
         } else {
             //socket.userIndex = users.length;
-            socket.nickname = nickname;
-            users.push(nickname);
+            socket.nickname = sanitizehtml(nickname);
+            users.push(sanitizehtml(nickname));
             socket.emit('loginSuccess');
-            io.sockets.emit('system', nickname, users.length, 'login');
+            io.sockets.emit('system', sanitizehtml(nickname), users.length, 'login');
         };
     });
     //user leaves
     socket.on('disconnect', function() {
         if (socket.nickname != null) {
             //users.splice(socket.userIndex, 1);
             users.splice(users.indexOf(socket.nickname), 1);
-            socket.broadcast.emit('system', socket.nickname, users.length, 'logout');
+            socket.broadcast.emit('system', sanitizehtml(socket.nickname), users.length, 'logout');
         }
     });
     //new message get
     socket.on('postMsg', function(msg, color) {
-        socket.broadcast.emit('newMsg', socket.nickname, msg, color);
+        socket.broadcast.emit('newMsg', sanitizehtml(socket.nickname), sanitizehtml(msg), color);
     });
     //new image get
     socket.on('img', function(imgData, color) {
-        socket.broadcast.emit('newImg', socket.nickname, imgData, color);
+        socket.broadcast.emit('newImg', sanitizehtml(socket.nickname), sanitizehtml(imgData), color);
     });
 });

www/index.html

@@ -47,6 +47,8 @@ <h1>HiChat :)</h1>
         </footer>
         <script src="/socket.io/socket.io.js"></script>
         <script src="scripts/hichat.js"></script>
+        <script src="scripts/sanitizehtml.js"></script>
+        <script src="scripts/purify.js"></script>
         <script>
         /**REMOVE ME IF YOU CANT ACCESS GOOGLE SERVICE**/
           (function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){

www/scripts/hichat.js

@@ -25,7 +25,7 @@ HiChat.prototype = {
             document.getElementById('info').textContent = '!nickname is taken, choose another pls';
         });
         this.socket.on('loginSuccess', function() {
-            document.title = 'hichat | ' + document.getElementById('nicknameInput').value;
+            document.title = 'hichat | ' + sanitizeHtml(document.getElementById('nicknameInput').value);
             document.getElementById('loginWrapper').style.display = 'none';
             document.getElementById('messageInput').focus();
         });
@@ -48,7 +48,7 @@ HiChat.prototype = {
             that._displayImage(user, img, color);
         });
         document.getElementById('loginBtn').addEventListener('click', function() {
-            var nickName = document.getElementById('nicknameInput').value;
+            var nickName = sanitizeHtml(document.getElementById('nicknameInput').value);
             if (nickName.trim().length != 0) {
                 that.socket.emit('login', nickName);
             } else {
@@ -57,15 +57,15 @@ HiChat.prototype = {
         }, false);
         document.getElementById('nicknameInput').addEventListener('keyup', function(e) {
             if (e.keyCode == 13) {
-                var nickName = document.getElementById('nicknameInput').value;
+                var nickName = sanitizeHtml(document.getElementById('nicknameInput').value);
                 if (nickName.trim().length != 0) {
                     that.socket.emit('login', nickName);
                 };
             };
         }, false);
         document.getElementById('sendBtn').addEventListener('click', function() {
             var messageInput = document.getElementById('messageInput'),
-                msg = messageInput.value,
+                msg = sanitizeHtml(messageInput.value),
                 color = document.getElementById('colorStyle').value;
             messageInput.value = '';
             messageInput.focus();
@@ -77,7 +77,7 @@ HiChat.prototype = {
         }, false);
         document.getElementById('messageInput').addEventListener('keyup', function(e) {
             var messageInput = document.getElementById('messageInput'),
-                msg = messageInput.value,
+                msg = sanitizeHtml(messageInput.value),
                 color = document.getElementById('colorStyle').value;
             if (e.keyCode == 13 && msg.trim().length != 0) {
                 messageInput.value = '';
@@ -123,7 +123,7 @@ HiChat.prototype = {
             if (target.nodeName.toLowerCase() == 'img') {
                 var messageInput = document.getElementById('messageInput');
                 messageInput.focus();
-                messageInput.value = messageInput.value + '[emoji:' + target.title + ']';
+                messageInput.value = sanitizeHtml(messageInput.value) + '[emoji:' + target.title + ']';
             };
         }, false);
     },
@@ -139,6 +139,8 @@ HiChat.prototype = {
         emojiContainer.appendChild(docFragment);
     },
     _displayNewMsg: function(user, msg, color) {
+        msg = DOMPurify.sanitize(msg, {SAFE_FOR_JQUERY: true});
+        user = DOMPurify.sanitize(user, {SAFE_FOR_JQUERY: true});
         var container = document.getElementById('historyMsg'),
             msgToDisplay = document.createElement('p'),
             date = new Date().toTimeString().substr(0, 8),
@@ -150,6 +152,8 @@ HiChat.prototype = {
         container.scrollTop = container.scrollHeight;
     },
     _displayImage: function(user, imgData, color) {
+        imgData = DOMPurify.sanitize(imgData, {SAFE_FOR_JQUERY: true});
+        user = DOMPurify.sanitize(user, {SAFE_FOR_JQUERY: true});
         var container = document.getElementById('historyMsg'),
             msgToDisplay = document.createElement('p'),
             date = new Date().toTimeString().substr(0, 8);
@@ -159,6 +163,7 @@ HiChat.prototype = {
         container.scrollTop = container.scrollHeight;
     },
     _showEmoji: function(msg) {
+        msg = DOMPurify.sanitize(msg, {SAFE_FOR_JQUERY: true});
         var match, result = msg,
             reg = /\[emoji:\d+\]/g,
             emojiIndex,