fix: sanitise html (#370)

Author: Naomi Carrigan

apps/anonymous-message-board/controllers/replyHandler.js

@@ -1,6 +1,7 @@
 const MongoClient = require("mongodb").MongoClient;
 const ObjectId = require("mongodb").ObjectID;
 const CONNECTION_STRING = process.env.DB_URI;
+const sanitizeHtml = require("sanitize-html");
 
 function ReplyHandler() {
   this.replyList = function (req, res) {
@@ -35,7 +36,7 @@ function ReplyHandler() {
     const now = new Date();
     const reply = {
       _id: new ObjectId(),
-      text: req.body.text,
+      text: sanitizeHtml(req.body.text),
       created_on: now,
       reported: false,
       delete_password: req.body.delete_password,
@@ -52,7 +53,7 @@ function ReplyHandler() {
             $set: { bumped_on: now },
             $push: { replies: reply },
           },
-          () => {}
+          () => { }
         );
       }
     );
@@ -73,7 +74,7 @@ function ReplyHandler() {
             "replies._id": new ObjectId(req.body.reply_id),
           },
           { $set: { "replies.$.reported": true } },
-          () => {}
+          () => { }
         );
       }
     );

apps/anonymous-message-board/controllers/threadHandler.js

@@ -1,6 +1,7 @@
 const MongoClient = require("mongodb").MongoClient;
 const ObjectId = require("mongodb").ObjectID;
 const CONNECTION_STRING = process.env.DB_URI;
+const sanitizeHtml = require("sanitize-html");
 
 function ThreadHandler() {
   this.threadList = function (req, res) {
@@ -41,7 +42,7 @@ function ThreadHandler() {
   this.newThread = function (req, res) {
     const board = req.params.board;
     const thread = {
-      text: req.body.text,
+      text: sanitizeHtml(req.body.text),
       created_on: new Date(),
       bumped_on: new Date(),
       reported: false,
@@ -73,7 +74,7 @@ function ThreadHandler() {
         collection.findOneAndUpdate(
           { _id: new ObjectId(req.body.report_id) },
           { $set: { reported: true } },
-          () => {}
+          () => { }
         );
       }
     );

apps/anonymous-message-board/package.json

@@ -16,7 +16,8 @@
     "express": "4.18.2",
     "helmet": "3.23.3",
     "mocha": "9.2.2",
-    "mongodb": "3.7.3"
+    "mongodb": "3.7.3",
+    "sanitize-html": "^2.8.1"
   },
   "license": "MIT"
 }