From b48ac2a61891c3135639546708d65e5348c566fe Mon Sep 17 00:00:00 2001 From: patak Date: Tue, 18 Apr 2023 11:32:25 +0200 Subject: [PATCH] fix: escape msg in render restricted error html, backport (#12889) (#12892) --- packages/vite/package.json | 2 ++ packages/vite/src/node/server/middlewares/static.ts | 3 ++- pnpm-lock.yaml | 8 ++++++++ 3 files changed, 12 insertions(+), 1 deletion(-) diff --git a/packages/vite/package.json b/packages/vite/package.json index 3f3c15934cc197..33e55befd6170b 100644 --- a/packages/vite/package.json +++ b/packages/vite/package.json @@ -78,6 +78,7 @@ "@rollup/plugin-node-resolve": "14.1.0", "@rollup/plugin-typescript": "^8.5.0", "@rollup/pluginutils": "^4.2.1", + "@types/escape-html": "^1.0.0", "acorn": "^8.8.1", "acorn-walk": "^8.2.0", "cac": "^6.7.14", @@ -92,6 +93,7 @@ "dotenv": "^14.3.2", "dotenv-expand": "^5.1.0", "es-module-lexer": "^1.1.0", + "escape-html": "^1.0.3", "estree-walker": "^3.0.1", "etag": "^1.8.1", "fast-glob": "^3.2.12", diff --git a/packages/vite/src/node/server/middlewares/static.ts b/packages/vite/src/node/server/middlewares/static.ts index c877022a63cde7..d9eadc4fee8cb7 100644 --- a/packages/vite/src/node/server/middlewares/static.ts +++ b/packages/vite/src/node/server/middlewares/static.ts @@ -3,6 +3,7 @@ import type { OutgoingHttpHeaders, ServerResponse } from 'node:http' import type { Options } from 'sirv' import sirv from 'sirv' import type { Connect } from 'dep-types/connect' +import escapeHtml from 'escape-html' import type { ViteDevServer } from '../..' import { FS_PREFIX } from '../../constants' import { @@ -208,7 +209,7 @@ function renderRestrictedErrorHTML(msg: string): string { return html`

403 Restricted

-

${msg.replace(/\n/g, '
')}

+

${escapeHtml(msg).replace(/\n/g, '
')}