ecki/Node.js-14-Cookbook
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Chapter 9: Malicious input samples

Browse Source
This commit is contained in:
Beth Griggs
2020-09-06 05:07:09 +01:00
parent ddbc582176
commit 000c8dd1a7
4 changed files with 11 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Chapter09/express-xss/collection-server.js
+4 -3
View File
@@ -2,8 +2,9 @@ require("http")
.createServer((req, res) => { .createServer((req, res) => {
console.log( console.log(
req.connection.remoteAddress, req.connection.remoteAddress,
Buffer(req.url.split("/attack/")[1], "base64").toString().trim() Buffer.from(req.url.split("/attack/")[1], "base64").toString().trim()
); );
}) })
.listen(3001); .listen(3001, () => {
console.log("Collection Server listening on port 3001");
});
Chapter09/express-xss/fixed-server.js
+2 -3
View File
@@ -2,13 +2,13 @@ const express = require("express");
const app = express(); const app = express();
const he = require("he"); const he = require("he");
app.get("*", (req, res) => { app.get("/", (req, res) => {
const { previous, lang, token } = req.query; const { previous, lang, token } = req.query;
getServiceStatus((status) => { getServiceStatus((status) => {
const href = he.encode(`${previous}${token}/${lang}`); const href = he.encode(`${previous}${token}/${lang}`);
res.send(` res.send(`
<h1>Service Status</h1> <h1>Service Status</h1>
<div id=status> <div id=status>
${status} ${status}
</div> </div>
<div> <div>
@@ -26,4 +26,3 @@ getServiceStatus = (callback) => {
app.listen(3000, () => { app.listen(3000, () => {
console.log("Server listening on port 3000"); console.log("Server listening on port 3000");
}); });
Chapter09/express-xss/protocol-safe-server.js
+3 -4
View File
@@ -2,11 +2,11 @@ const express = require("express");
const app = express(); const app = express();
const escapeHTML = require("escape-html"); const escapeHTML = require("escape-html");
app.get("*", (req, res) => { app.get("/", (req, res) => {
const { previous, lang, token } = req.query; const { previous, lang, token } = req.query;
getServiceStatus((status) => { getServiceStatus((status) => {
const href = escapeHTML(`/${previous}${token}/${lang}`); const href = escapeHTML(`/${previous}${token}/${lang}`);
res.send(` res.send(`
<h1>Service Status</h1> <h1>Service Status</h1>
<div id=status> <div id=status>
${status} ${status}
@@ -26,4 +26,3 @@ getServiceStatus = (callback) => {
app.listen(3000, () => { app.listen(3000, () => {
console.log("Server listening on port 3000"); console.log("Server listening on port 3000");
}); });
Chapter09/express-xss/server.js
+2 -3
View File
@@ -1,12 +1,12 @@
const express = require("express"); const express = require("express");
const app = express(); const app = express();
app.get("*", (req, res) => { app.get("/", (req, res) => {
const { previous, lang, token } = req.query; const { previous, lang, token } = req.query;
getServiceStatus((status) => { getServiceStatus((status) => {
res.send(` res.send(`
<h1>Service Status</h1> <h1>Service Status</h1>
<div id=status> <div id=status>
${status} ${status}
</div> </div>
<div> <div>
@@ -24,4 +24,3 @@ getServiceStatus = (callback) => {
app.listen(3000, () => { app.listen(3000, () => {
console.log("Server listening on port 3000"); console.log("Server listening on port 3000");
}); });