escape

haileyok · haileyok · commit 793a2bd78d7f · 2025-03-19T13:02:59.000-07:00
diff --git a/bskylink/package.json b/bskylink/package.json
@@ -9,8 +9,10 @@
   },
   "dependencies": {
     "@atproto/common": "^0.4.0",
+    "@types/escape-html": "^1.0.4",
     "body-parser": "^1.20.2",
     "cors": "^2.8.5",
+    "escape-html": "^1.0.3",
     "express": "^4.19.2",
     "http-terminator": "^3.2.0",
     "kysely": "^0.27.3",
diff --git a/bskylink/src/routes/redirect.ts b/bskylink/src/routes/redirect.ts
@@ -1,6 +1,7 @@
 import assert from 'node:assert'
 
 import {DAY, SECOND} from '@atproto/common'
+import escapeHTML from 'escape-html'
 import {Express} from 'express'
 
 import {AppContext} from '../context.js'
@@ -42,8 +43,10 @@ export default function (ctx: AppContext, app: Express) {
       res.setHeader('Cache-Control', `max-age=${(7 * DAY) / SECOND}`)
       res.type('html')
       res.status(200)
+
+      const escaped = escapeHTML(url.href)
       return res.send(
-        `<html><head><meta http-equiv="refresh" content="0; URL='${url.href}'" /><style>:root { color-scheme: light dark; }</style></head></html>`,
+        `<html><head><meta http-equiv="refresh" content="0; URL='${escaped}'" /><style>:root { color-scheme: light dark; }</style></head></html>`,
       )
     }),
   )
diff --git a/bskylink/yarn.lock b/bskylink/yarn.lock
@@ -69,6 +69,11 @@
   dependencies:
     "@types/node" "*"
 
+"@types/escape-html@^1.0.4":
+  version "1.0.4"
+  resolved "https://registry.yarnpkg.com/@types/escape-html/-/escape-html-1.0.4.tgz#dc7c166b76c7b03b27e32f80edf01d91eb5d9af2"
+  integrity sha512-qZ72SFTgUAZ5a7Tj6kf2SHLetiH5S6f8G5frB2SPQ3EyF02kxdyBFf4Tz4banE3xCgGnKgWLt//a6VuYHKYJTg==
+
 "@types/node@*":
   version "20.14.2"
   resolved "https://registry.yarnpkg.com/@types/node/-/node-20.14.2.tgz#a5f4d2bcb4b6a87bffcaa717718c5a0f208f4a18"
@@ -276,7 +281,7 @@ es-errors@^1.3.0:
   resolved "https://registry.yarnpkg.com/es-errors/-/es-errors-1.3.0.tgz#05f75a25dab98e4fb1dcd5e1472c0546d5057c8f"
   integrity sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==
 
-escape-html@~1.0.3:
+escape-html@^1.0.3, escape-html@~1.0.3:
   version "1.0.3"
   resolved "https://registry.yarnpkg.com/escape-html/-/escape-html-1.0.3.tgz#0258eae4d3d0c0974de1c169188ef0051d1d1988"
   integrity sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==
