alois/Verso
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Implement sanitization of control characters in user input for hackerone (#32521)

Browse Source 
GitOrigin-RevId: 859299da44b1c60220592c8f71a90536a5aa34a3
This commit is contained in:
Anna Claire Fields
2026-04-14 08:04:36 +00:00
committed by Copybot
parent 1a7de4ddd8
commit 2487b73962
5 changed files with 100 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/web/app/src/Features/User/UserController.mjs
+9 -8
View File
@@ -18,6 +18,7 @@ import EmailHandler from '../Email/EmailHandler.mjs'
import UrlHelper from '../Helpers/UrlHelper.mjs'
import { promisify } from 'node:util'
import { expressify } from '@overleaf/promise-utils'
import { sanitizeControlCharacters } from '../../infrastructure/Sanitize.mjs'
import { acceptsJson } from '../../infrastructure/RequestContentTypeDetection.mjs'
import Modules from '../../infrastructure/Modules.mjs'
import OneTimeTokenHandler from '../Security/OneTimeTokenHandler.mjs'
@@ -361,17 +362,17 @@ async function updateUserSettings(req, res, next) {
throw new OError('problem updating user settings', { userId })
}
if (body.first_name != null) {
user.first_name = body.first_name.trim()
if (typeof body.first_name === 'string') {
user.first_name = sanitizeControlCharacters(body.first_name).trim()
}
if (body.last_name != null) {
user.last_name = body.last_name.trim()
if (typeof body.last_name === 'string') {
user.last_name = sanitizeControlCharacters(body.last_name).trim()
}
if (body.role != null) {
user.role = body.role.trim()
if (typeof body.role === 'string') {
user.role = sanitizeControlCharacters(body.role).trim()
}
if (body.institution != null) {
user.institution = body.institution.trim()
if (typeof body.institution === 'string') {
user.institution = sanitizeControlCharacters(body.institution).trim()
}
if (body.mode != null) {
user.ace.mode = body.mode