generated from hmcts/expressjs-template
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
ADOP-2523 Escaping characters to prevent HTML injection (#1587)
* [ADOP-2523] removed redundant code * [ADOP-2523] Removed duplicated code tech debt
- Loading branch information
Showing
9 changed files
with
156 additions
and
1,299 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,18 +1,27 @@ | ||
| import { sanitizeHtmlArray } from '../../../steps/common/functions/sanitize'; | ||
| import { Case, FieldPrefix } from '../case'; | ||
|
|
||
| export const getFormattedAddress = (data: Partial<Case>, prefix: FieldPrefix): string => { | ||
| let address: string[] = []; | ||
|
|
||
| address.push(data[`${prefix}Address1`] || ''); | ||
| address.push(data[`${prefix}Address2`] || ''); | ||
| address.push(data[`${prefix}Address3`] || ''); | ||
| address.push(data[`${prefix}AddressTown`] || ''); | ||
| address.push(data[`${prefix}AddressCounty`] || ''); | ||
| address.push(data[`${prefix}AddressPostcode`] || ''); | ||
| address.push(data[`${prefix}AddressCountry`] || ''); | ||
| if (prefix === FieldPrefix.OTHER_ADOPTION_AGENCY) { | ||
| address.push(data[`${prefix}AddressLine1`] || ''); | ||
| address.push(data[`${prefix}Town`] || ''); | ||
| address.push(data[`${prefix}Postcode`] || ''); | ||
| } else { | ||
| address.push(data[`${prefix}Address1`] || ''); | ||
| address.push(data[`${prefix}Address2`] || ''); | ||
| address.push(data[`${prefix}Address3`] || ''); | ||
| address.push(data[`${prefix}AddressTown`] || ''); | ||
| address.push(data[`${prefix}AddressCounty`] || ''); | ||
| address.push(data[`${prefix}AddressPostcode`] || ''); | ||
| address.push(data[`${prefix}AddressCountry`] || ''); | ||
| } | ||
|
|
||
| //remove empty items | ||
| address = address.filter(item => !!item); | ||
|
|
||
| address = sanitizeHtmlArray(address); | ||
|
|
||
| return address.join('<br>'); | ||
| }; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| import { sanitizeHtml, sanitizeHtmlArray } from './sanitize'; | ||
|
|
||
| test('Changes nothing in a string with no special characters', () => { | ||
| const testString = 'This is a test string 123'; | ||
| expect(sanitizeHtml(testString)).toBe(testString); | ||
| }); | ||
|
|
||
| test('Returns undefined where input is undefined', () => { | ||
| let testString; | ||
| expect(sanitizeHtml(testString)).toBe(undefined); | ||
| }); | ||
|
|
||
| test('Escapes special characters when input contains HTML', () => { | ||
| const input = '<h2>HTML Injection</h2>'; | ||
| const expected = '<h2>HTML Injection</h2>'; | ||
| expect(sanitizeHtml(input)).toBe(expected); | ||
| }); | ||
|
|
||
| test('Returns empty array when passed empty array', () => { | ||
| const testArray = []; | ||
| expect(sanitizeHtmlArray(testArray)).toStrictEqual([]); | ||
| }); | ||
|
|
||
| test('Return undefined where array is undefined', () => { | ||
| let testArray; | ||
| expect(sanitizeHtmlArray(testArray)).toStrictEqual(undefined); | ||
| }); | ||
|
|
||
| test('Escapes special characters when input array contains HTML', () => { | ||
| const testArray = ['<h2>HTML Injection</h2>', "321 St Christopher-Walden's", 'Nothing to see here']; | ||
| const expected = [ | ||
| '<h2>HTML Injection</h2>', | ||
| '321 St Christopher-Walden's', | ||
| 'Nothing to see here', | ||
| ]; | ||
| expect(sanitizeHtmlArray(testArray)).toStrictEqual(expected); | ||
| }); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| export function sanitizeHtml(input: string): string { | ||
| const map: Record<string, string> = { | ||
| '&': '&', | ||
| '<': '<', | ||
| '>': '>', | ||
| '"': '"', | ||
| "'": ''', | ||
| '/': '/', | ||
| '`': '`', | ||
| '=': '=', | ||
| }; | ||
| const reg = /[&<>"'`=/]/gi; | ||
|
|
||
| if (input) { | ||
| return input.replace(reg, match => map[match]); | ||
| } | ||
| return input; | ||
| } | ||
|
|
||
| export function sanitizeHtmlArray(input: string[]): string[] { | ||
| if (input) { | ||
| return input.map(item => sanitizeHtml(item)); | ||
| } | ||
| return input; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.