From 217d142324d662993656ddf5893f5858761ad0e5 Mon Sep 17 00:00:00 2001 From: ArshLabs Date: Sun, 15 Mar 2026 22:48:36 +0530 Subject: [PATCH] fix: sanitize claim_id to prevent XSS in HTML response claim_id from the request path was interpolated directly into an HTML string returned by the server with no escaping. A malicious claim ID could inject arbitrary HTML or JavaScript into the page. Added escapeHtml() utility and applied it to all claim_id interpolations in HTML template literals. --- lensmint-public-server/server.js | 27 ++++++++++++++++++--------- 1 file changed, 18 insertions(+), 9 deletions(-) diff --git a/lensmint-public-server/server.js b/lensmint-public-server/server.js index 313c3b6..d2c5b96 100644 --- a/lensmint-public-server/server.js +++ b/lensmint-public-server/server.js @@ -6,6 +6,15 @@ require('dotenv').config(); const dbService = require('./dbService'); +function escapeHtml(str) { + return String(str) + .replace(/&/g, '&') + .replace(//g, '>') + .replace(/"/g, '"') + .replace(/'/g, '''); +} + const app = express(); const PORT = process.env.PORT || 5001; @@ -260,7 +269,7 @@ app.get('/verify/:claim_id', async (req, res) => {

Claim Not Found

-

The claim ID "${claim_id}" does not exist.

+

The claim ID "${escapeHtml(claim_id)}" does not exist.

`); @@ -346,7 +355,7 @@ app.get('/verify/:claim_id', async (req, res) => {

🔐 ZK Proof Verification

-

Claim ID: ${claim_id}

+

Claim ID: ${escapeHtml(claim_id)}

@@ -428,8 +437,8 @@ app.get('/verify/:claim_id', async (req, res) => {
- View Claim Page - View Metadata API + View Claim Page + View Metadata API
@@ -443,7 +452,7 @@ app.get('/verify/:claim_id', async (req, res) => { Error

Error

-

${error.message}

+

${escapeHtml(error.message)}

`); @@ -507,7 +516,7 @@ app.get('/claim/:claim_id', (req, res) => {

Claim Not Found

-

The claim ID "${claim_id}" does not exist.

+

The claim ID "${escapeHtml(claim_id)}" does not exist.

`); @@ -781,17 +790,17 @@ app.get('/claim/:claim_id', (req, res) => {
-
Claim ID: ${claim_id}
+
Claim ID: ${escapeHtml(claim_id)}
- + 🔐 Check ZK Proof Verification