SpookyDervish/chookchat
1
0
Fork 0
forked from chookspace/chookchat
Code Pull Requests Activity

Fix username html injection

Browse Source
This commit is contained in:
Maxwell
2026-07-20 20:53:33 +10:00
parent b4750b9053
commit fa20bf7fc4
2 changed files with 17 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
server/src/db.h
View File

@@ -9,13 +9,18 @@
#include "post.h" #include "post.h"
void sanitize(std::string& str);
struct User { struct User {
uint64_t id = 0; uint64_t id = 0;
std::string name = ""; std::string name = "";
std::string passwordHash = ""; std::string passwordHash = "";
User(uint64_t id, const std::string& name, const std::string& passwordHash) : User(uint64_t id, std::string namein, const std::string& passwordHash) :
id(id), name(name), passwordHash(passwordHash) {} id(id), passwordHash(passwordHash) {
sanitize(namein);
name = namein;
}
}; };
class Database { class Database {

20
server/src/post.cpp
View File

@@ -13,25 +13,25 @@ void replaceAll(std::string& str, const std::string& from, const std::string& to
} }
} }
void sanitize(std::string& str) {
replaceAll(str, "&", "&");
replaceAll(str, "<", "&lt;");
replaceAll(str, ">", "&gt;");
replaceAll(str, "\"", "&quot;");
replaceAll(str, "'", "&apos;");
}
Post::Post(std::string contentin, const std::string& user) : user(user), time(std::time(nullptr)) { Post::Post(std::string contentin, const std::string& user) : user(user), time(std::time(nullptr)) {
replaceAll(contentin, "&", "&amp;");
replaceAll(contentin, "<", "&lt;");
replaceAll(contentin, ">", "&gt;");
replaceAll(contentin, "\"", "&quot;");
replaceAll(contentin, "'", "&apos;");
// parse the post content markdown // parse the post content markdown
sanitize(contentin);
std::stringstream input(contentin); std::stringstream input(contentin);
std::shared_ptr<maddy::Parser> parser = std::make_shared<maddy::Parser>(); std::shared_ptr<maddy::Parser> parser = std::make_shared<maddy::Parser>();
content = parser->Parse(input); content = parser->Parse(input);
} }
Post::Post(std::string contentin, uint64_t user) : userId(user), time(std::time(nullptr)) { Post::Post(std::string contentin, uint64_t user) : userId(user), time(std::time(nullptr)) {
replaceAll(contentin, "&", "&amp;");
replaceAll(contentin, "<", "&lt;");
replaceAll(contentin, ">", "&gt;");
replaceAll(contentin, "\"", "&quot;");
replaceAll(contentin, "'", "&apos;");
// parse the post content markdown // parse the post content markdown
sanitize(contentin);
std::stringstream input(contentin); std::stringstream input(contentin);
std::shared_ptr<maddy::Parser> parser = std::make_shared<maddy::Parser>(); std::shared_ptr<maddy::Parser> parser = std::make_shared<maddy::Parser>();
content = parser->Parse(input); content = parser->Parse(input);