@opengis/fastify-table/server/plugins/policy/funcs/checkXSS.js

core-plugins

import config from '../../../../config.js';
import xssInjection from '../xssInjection.js';

function checkXSS({ body, schema = {} }) {
  const data = typeof body === 'string' ? body : JSON.stringify(body);
  const stopWords = xssInjection.filter((el) => data?.toLowerCase?.()?.includes?.(el));

  // check sql injection
  const stopSpecialSymbols = data.match(/\p{S}OR\p{S}|\p{P}OR\p{P}| OR |\+OR\+/gi);
  if (stopSpecialSymbols?.length) stopSpecialSymbols?.forEach((el) => stopWords.push(el));

  // escape arrows on non-rich text editor inputs
  const skipScreening = config.skipScreening || ['Summernote', 'Tiny', 'Ace', 'Texteditor'];
  Object.keys(body)
    .filter((key) => ['<', '>'].find((el) => body[key]?.includes?.(el))
      && !skipScreening.includes(schema?.[key]?.type))
    ?.forEach((key) => {
      Object.assign(body, { [key]: body[key].replace(/</g, '&lt;').replace(/>/g, '&gt;') });
    });

  if (!stopWords.length) return { body };

  const disabledCheckFields = Object.keys(schema || {})?.filter((el) => schema?.[el]?.xssCheck === false); // exclude specific columns

  const field = Object.keys(body)
    ?.find((key) => body[key]?.toLowerCase
      && !disabledCheckFields.includes(key)
      && (skipScreening.includes(schema?.[key]?.type) ? stopWords.find(el => !['href=', 'src='].includes(el)) : true)
      && body[key].toLowerCase().includes(stopWords[0]));
  if (field) {
    console.error(stopWords[0], field, body[field]);
    return { error: `rule: ${stopWords[0]} | attr: ${field} | val: ${body[field]}`, body };
  }
  return { body };
}

export default checkXSS;