Fix XSS injection issues

shakacode · Dec 14, 2023 · 0372181 · 0372181
1 parent bda8631
commit 0372181
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 1 deletion.
diff --git a/lib/jstreamer.rb b/lib/jstreamer.rb
@@ -87,6 +87,6 @@ def generate(template, object = nil, **options)
  # Creates new stream (low-level engine)
  # @return stream low-level engine
  def create_new_stream
- Oj::StringWriter.new
+ Oj::StringWriter.new(escape_mode: :xss_safe)
  end
 end
diff --git a/spec/jstreamer_spec.rb b/spec/jstreamer_spec.rb
@@ -29,5 +29,23 @@ def render
  it "retruns stream" do
  expect(described_class.create_new_stream).not_to be_nil
  end
+
+ it "handles Unicode XSS injections" do
+ stream = described_class.create_new_stream
+
+ stream.push_value("\u2028\u2029\u0000", "x")
+ result = stream.to_s.split(":").last
+
+ expect(result).to eq('"\\u2028\\u2029\\u0000"')
+ end
+
+ it "handles HTML XSS injections" do
+ stream = described_class.create_new_stream
+
+ stream.push_value("<>&", "x")
+ result = stream.to_s.split(":").last
+
+ expect(result).to eq('"\\u003c\\u003e\\u0026"')
+ end
  end
 end