How to troubleshoot Xss vulnerability in Node.js and socket.io-based chat

Asked Jun 11 '19 at 10:38

Active Jun 11 '19 at 11:14

Viewed 145 times

I'm developing a simple chat application based on node.js and socket.io. There is an XSS vulnerability. How can I filter HTML codes in input data entries?

btn.addEventListener('click', function(){
    socket.emit('chat', {   
        message: message.value,
        kullanıcıadı: kullanıcıadı.value
    });

edited Jun 11 '19 at 11:14

Sami Ahmed Siddiqui

2,328
1
16
29

asked Jun 11 '19 at 10:38

Ata

You could set the message like `element.textContent = 'user messageasd';`. This way the message is not executed. – Roland Starke Jun 11 '19 at 10:41
striptags or sanitize-html npm package might help. – user269867 Jun 12 '19 at 17:31
This might help: https://stackoverflow.com/questions/10862271/socket-io-sanitize-incoming-data-xss – jim1427 Jun 13 '19 at 10:43

How to troubleshoot Xss vulnerability in Node.js and socket.io-based chat

0 Answers0