Escape opengraph/oembed tags

[github/Chocobozzz/PeerTube.git] / server / helpers / core-utils.ts

diff --git a/server/helpers/core-utils.ts b/server/helpers/core-utils.ts
index f8dd45533f352a05c6f85e2c0de3948e3dd9d3a3..33bbdca8b6b44f1a95516fe93359d53da7a5f47e 100644 (file)
--- a/server/helpers/core-utils.ts
+++ b/server/helpers/core-utils.ts
@@ -11,7 +11,9 @@ import {
   rename,
   unlink,
   writeFile,
-  access
+  access,
+  stat,
+  Stats
 } from 'fs'
 import * as mkdirp from 'mkdirp'
 import * as bcrypt from 'bcrypt'
@@ -25,8 +27,31 @@ function isTestInstance () {
 }
 
 function root () {
-  // We are in /dist/helpers/utils.js
-  return join(__dirname, '..', '..', '..')
+  // We are in /helpers/utils.js
+  const paths = [ __dirname, '..', '..' ]
+
+  // We are under /dist directory
+  if (process.mainModule.filename.endsWith('.ts') === false) {
+    paths.push('..')
+  }
+
+  return join.apply(null, paths)
+}
+
+// Thanks: https://stackoverflow.com/a/12034334
+function escapeHTML (stringParam) {
+  const entityMap = {
+    '&': '&',
+    '<': '&lt;',
+    '>': '&gt;',
+    '"': '&quot;',
+    "'": '&#39;',
+    '/': '&#x2F;',
+    '`': '&#x60;',
+    '=': '&#x3D;'
+  }
+
+  return String(stringParam).replace(/[&<>"'`=\/]/g, s => entityMap[s])
 }
 
 function promisify0<A> (func: (cb: (err: any, result: A) => void) => void): () => Promise<A> {
@@ -85,12 +110,14 @@ const bcryptGenSaltPromise = promisify1<number, string>(bcrypt.genSalt)
 const bcryptHashPromise = promisify2<any, string|number, string>(bcrypt.hash)
 const createTorrentPromise = promisify2<string, any, any>(createTorrent)
 const rimrafPromise = promisify1WithVoid<string>(rimraf)
+const statPromise = promisify1<string, Stats>(stat)
 
 // ---------------------------------------------------------------------------
 
 export {
   isTestInstance,
   root,
+  escapeHTML,
 
   promisify0,
   promisify1,
@@ -108,5 +135,6 @@ export {
   bcryptGenSaltPromise,
   bcryptHashPromise,
   createTorrentPromise,
-  rimrafPromise
+  rimrafPromise,
+  statPromise
 }