fix(auth): sanitize error messages in error page
Add basic XSS sanitization by removing angle brackets from error URL parameters before rendering.
This commit is contained in:
@@ -9,9 +9,14 @@ import { Suspense } from "react"
|
|||||||
function Search() {
|
function Search() {
|
||||||
const searchParams = useSearchParams()
|
const searchParams = useSearchParams()
|
||||||
const errorMessage = searchParams.get('error')
|
const errorMessage = searchParams.get('error')
|
||||||
|
|
||||||
|
// Sanitize error message to prevent XSS
|
||||||
|
const sanitizedError = errorMessage
|
||||||
|
? errorMessage.replace(/[<>]/g, '')
|
||||||
|
: 'An authentication error occurred'
|
||||||
|
|
||||||
return (<div className="text-center p-3 bg-background rounded-lg">
|
return (<div className="text-center p-3 bg-background rounded-lg">
|
||||||
{errorMessage}
|
{sanitizedError}
|
||||||
</div>)
|
</div>)
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user