Chapter 9: Malicious input samples

Chapter09/express-xss/collection-server.js

@@ -2,8 +2,9 @@ require("http")
   .createServer((req, res) => {
     console.log(
       req.connection.remoteAddress,
-      Buffer(req.url.split("/attack/")[1], "base64").toString().trim()
+      Buffer.from(req.url.split("/attack/")[1], "base64").toString().trim()
     );
   })
-  .listen(3001);
-
+  .listen(3001, () => {
+    console.log("Collection Server listening on port 3001");
+  });

Chapter09/express-xss/fixed-server.js

@@ -2,13 +2,13 @@ const express = require("express");
 const app = express();
 const he = require("he");
 
-app.get("*", (req, res) => {
+app.get("/", (req, res) => {
   const { previous, lang, token } = req.query;
   getServiceStatus((status) => {
     const href = he.encode(`${previous}${token}/${lang}`);
     res.send(`
       <h1>Service Status</h1>
-      <div id=status>  
+      <div id=status>
         ${status}
       </div>
       <div>
@@ -26,4 +26,3 @@ getServiceStatus = (callback) => {
 app.listen(3000, () => {
   console.log("Server listening on port 3000");
 });
-

Chapter09/express-xss/protocol-safe-server.js

@@ -2,11 +2,11 @@ const express = require("express");
 const app = express();
 const escapeHTML = require("escape-html");
 
-app.get("*", (req, res) => {
+app.get("/", (req, res) => {
   const { previous, lang, token } = req.query;
   getServiceStatus((status) => {
-      const href = escapeHTML(`/${previous}${token}/${lang}`);
-      res.send(`
+    const href = escapeHTML(`/${previous}${token}/${lang}`);
+    res.send(`
       <h1>Service Status</h1>
       <div id=status>  
         ${status}
@@ -26,4 +26,3 @@ getServiceStatus = (callback) => {
 app.listen(3000, () => {
   console.log("Server listening on port 3000");
 });
-

Chapter09/express-xss/server.js

@@ -1,12 +1,12 @@
 const express = require("express");
 const app = express();
 
-app.get("*", (req, res) => {
+app.get("/", (req, res) => {
   const { previous, lang, token } = req.query;
   getServiceStatus((status) => {
     res.send(`
       <h1>Service Status</h1>
-      <div id=status>  
+      <div id=status>
         ${status}
       </div>
       <div>
@@ -24,4 +24,3 @@ getServiceStatus = (callback) => {
 app.listen(3000, () => {
   console.log("Server listening on port 3000");
 });
-