fix(auth): sanitize error messages in error page
Add basic XSS sanitization by removing angle brackets from error URL parameters before rendering.
This commit is contained in:
@@ -9,9 +9,14 @@ import { Suspense } from "react"
|
||||
function Search() {
|
||||
const searchParams = useSearchParams()
|
||||
const errorMessage = searchParams.get('error')
|
||||
|
||||
// Sanitize error message to prevent XSS
|
||||
const sanitizedError = errorMessage
|
||||
? errorMessage.replace(/[<>]/g, '')
|
||||
: 'An authentication error occurred'
|
||||
|
||||
return (<div className="text-center p-3 bg-background rounded-lg">
|
||||
{errorMessage}
|
||||
{sanitizedError}
|
||||
</div>)
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user