names of some users are stored with HTML entities

[ElectricNroff]

Using the PUT /org/{shortname}/user/{username} endpoint with a query string of

name.first=Walter&name.last=O'Reilly

results in a response containing

"name":{"first":"Walter","last":"O'Reilly",

because of escape() in

cve-services/src/controller/org.controller/index.js

Line 708 in b083cfe

query(['name.last']).optional().isString().trim().escape(),

It's unclear why the HTML entity is used for the quote character in O'Reilly. There is no documentation stating that some parts of API responses are supposed to be interpreted as HTML.

If a client application receives a list of users and their names, it should probably be the client's responsibility to encode the data in a way that is valid and safe for the specific context. The server doesn't comprehensively ensure safe content for all possible client contexts, e.g., the CVE Services code does not prevent use of

javascript:alert(document.domain)

in the name.last field, and does not modify that string in any way. Having the server send HTML entities to the client makes it harder for the client to do input validation, e.g., the client would need to know the places in which double encoding must be avoided.

[slubar]

Also updating user creation and org create and update to ensure that no HTML entities for names are added to the database or included in the http response