fix(auth): sanitize error messages in error page

Add basic XSS sanitization by removing angle brackets from error
URL parameters before rendering.
This commit is contained in:
old4ever committed 2026-04-06 23:26:09 -04:00
1 parent 4e7c56eec9
commit 403f41f078
1 file changed
+6 -1
+6 -1
View File
@@ -10,8 +10,13 @@ function Search() {
const searchParams = useSearchParams()
const errorMessage = searchParams.get('error')
// Sanitize error message to prevent XSS
const sanitizedError = errorMessage
? errorMessage.replace(/[<>]/g, '')
: 'An authentication error occurred'
return (<div className="text-center p-3 bg-background rounded-lg">
{errorMessage}
{sanitizedError}
</div>)
}