Escape opengraph/oembed tags

[github/Chocobozzz/PeerTube.git] / server / helpers / core-utils.ts

diff --git a/server/helpers/core-utils.ts b/server/helpers/core-utils.ts
index 2ec7e6515fc82982e573d29e08438436b709e7e1..33bbdca8b6b44f1a95516fe93359d53da7a5f47e 100644 (file)
--- a/server/helpers/core-utils.ts
+++ b/server/helpers/core-utils.ts
@@ -11,7 +11,9 @@ import {
   rename,
   unlink,
   writeFile,
-  access
+  access,
+  stat,
+  Stats
 } from 'fs'
 import * as mkdirp from 'mkdirp'
 import * as bcrypt from 'bcrypt'
@@ -36,6 +38,22 @@ function root () {
   return join.apply(null, paths)
 }
 
+// Thanks: https://stackoverflow.com/a/12034334
+function escapeHTML (stringParam) {
+  const entityMap = {
+    '&': '&',
+    '<': '&lt;',
+    '>': '&gt;',
+    '"': '&quot;',
+    "'": '&#39;',
+    '/': '&#x2F;',
+    '`': '&#x60;',
+    '=': '&#x3D;'
+  }
+
+  return String(stringParam).replace(/[&<>"'`=\/]/g, s => entityMap[s])
+}
+
 function promisify0<A> (func: (cb: (err: any, result: A) => void) => void): () => Promise<A> {
   return function promisified (): Promise<A> {
     return new Promise<A>((resolve: (arg: A) => void, reject: (err: any) => void) => {
@@ -92,12 +110,14 @@ const bcryptGenSaltPromise = promisify1<number, string>(bcrypt.genSalt)
 const bcryptHashPromise = promisify2<any, string|number, string>(bcrypt.hash)
 const createTorrentPromise = promisify2<string, any, any>(createTorrent)
 const rimrafPromise = promisify1WithVoid<string>(rimraf)
+const statPromise = promisify1<string, Stats>(stat)
 
 // ---------------------------------------------------------------------------
 
 export {
   isTestInstance,
   root,
+  escapeHTML,
 
   promisify0,
   promisify1,
@@ -115,5 +135,6 @@ export {
   bcryptGenSaltPromise,
   bcryptHashPromise,
   createTorrentPromise,
-  rimrafPromise
+  rimrafPromise,
+  statPromise
 }