Fix xss vulnerability (#418)

Co-authored-by: Viktor Baranov <baranov.viktor.27@gmail.com>
celo-org · Oct 6, 2021 · 8484e47 · 8484e47
1 parent 6e233ee
commit 8484e47
Show file tree

Hide file tree

Showing 4 changed files with 24 additions and 5 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -3,6 +3,7 @@
 ### Features
 
 ### Fixes
+- [#4713](https://github.com/blockscout/blockscout/pull/4713) - Search input field: sanitize input
 
 ### Chore
 

diff --git a/apps/block_scout_web/assets/js/lib/autocomplete.js b/apps/block_scout_web/assets/js/lib/autocomplete.js
@@ -1,6 +1,7 @@
 import AutoComplete from '@tarekraafat/autocomplete.js/dist/autoComplete.js'
 import { getTextAdData, fetchTextAdData } from './ad.js'
 import { DateTime } from 'luxon'
+import xss from 'xss'
 
 const placeHolder = 'Search by address, token symbol, name, transaction hash, or block number'
 const dataSrc = async (query, id) => {
@@ -106,6 +107,9 @@ const config = (id) => {
       element: (item, data) => resultItemElement(item, data),
       highlight: 'autoComplete_highlight'
     },
+    query: (input) => {
+      return xss(input)
+    },
     events: {
       input: {
         focus: () => {

diff --git a/apps/block_scout_web/assets/package-lock.json b/apps/block_scout_web/assets/package-lock.json
diff --git a/apps/block_scout_web/assets/package.json b/apps/block_scout_web/assets/package.json
@@ -58,7 +58,8 @@
     "urijs": "^1.19.7",
     "url": "^0.11.0",
     "util": "^0.12.4",
-    "web3": "^1.5.2"
+    "web3": "^1.5.2",
+    "xss": "^1.0.9"
   },
   "devDependencies": {
     "@babel/core": "^7.14.6",