FEAT: Add consult us form and update page hero #577
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
1 Skipped Deployment
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| const message = | ||
| (error as any)?.body?.message || "Issue while processing request"; | ||
|
|
||
| return new Response(JSON.stringify({ message }), { |
Check warning
Code scanning / CodeQL
Exception text reinterpreted as HTML Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 2 days ago
To fix the immediate problem, we should sanitize the error message before returning it in the API response. In concrete terms, this means escaping problematic HTML meta-characters (<, >, &, ", ') in the message string, so that if it is ever rendered directly as HTML in a browser, malicious payloads are defanged. The most robust and reliable way to do this is to use a library like he (https://github.com/mathiasbynens/he) or escape-html to encode HTML entities in the error message whenever an error is returned. In the given code, replace the assignment to message on line 136 with a version that escapes meta-characters, then use this escaped value in the error response on line 138. Only the error-handling code path needs fixing; successful responses do not return user-controlled content.
Additionally, you'll need to import the escaping utility at the top of the file.
Required changes:
- Add an import for HTML escaping (using
escape-html). - In the error catch block in the
POSThandler, sanitize the error message before it's returned in the JSON response.
| @@ -2,6 +2,7 @@ | ||
| import { nanoid } from "nanoid"; | ||
| import { NextRequest } from "next/server"; | ||
| import z from "zod"; | ||
| import escapeHtml from "escape-html"; | ||
|
|
||
| const { NOTION_GET_PLAN_DATABASE_ID } = process.env; | ||
|
|
||
| @@ -132,8 +133,9 @@ | ||
| console.error("Error - api/get-plan", error); | ||
|
|
||
| const statusCode = (error as any).statusCode || 501; | ||
| const message = | ||
| const rawMessage = | ||
| (error as any)?.body?.message || "Issue while processing request"; | ||
| const message = escapeHtml(rawMessage); | ||
|
|
||
| return new Response(JSON.stringify({ message }), { | ||
| status: statusCode, |
| @@ -14,7 +14,8 @@ | ||
| "next": "15.5.2", | ||
| "@notionhq/client": "^4.0.1", | ||
| "nanoid": "^5.0.9", | ||
| "zod": "^4.0.17" | ||
| "zod": "^4.0.17", | ||
| "escape-html": "^1.0.3" | ||
| }, | ||
| "devDependencies": { | ||
| "typescript": "^5", |
| Package | Version | Security advisories |
| escape-html (npm) | 1.0.3 | None |
stefanskoricdev
changed the title
Uh oh!
There was an error while loading. Please reload this page.