CODEWITHSUNDEEP
javascriptnode.jssecurityxss
Frosted Cupcake
Frosted Cupcake

Reputation: 1970

Getting reflected Cross-Site Scripting (XSS) attack in node js

I am getting Reflected Cross-Site Scripting (XSS) attack in the below chunk of code,

   const getData = async function (req, res) {
      const { query } = req.body;
      const requestBody = formRequestBody(query);
      const { authorization } = req.headers;
      try {
        const { data } = await axios(url, {
          body: requestBody,
          headers: {
            Authorization: authorization
          }
        });
        if (data) {
          res.send(data);
        }
      } catch (error) {
        console.log(error);
      }
    };

I tried adding a sanitary function and sanitized the query string like below,

const sanitizeString = (string) => {
  const escapeCharsMap = {
    '&': '&',
    '<': '&lt;',
    '>': '&gt;',
    '"': '&quot;',
    "'": '&#x27;',
    '/': '&#x2F;'
  };
  const reg = /[&<>"'/]/gi;
  return string.replace(reg, (match) => escapeCharsMap[match]);
};

I changed formRequestBody(query) to formRequestBody(sanitizeString(query)), still getting the issue.

How could I resolve it?

Upvotes: 0

Views: 1408

Answers (1)

Quentin
Quentin

Reputation: 944210

XSS attacks work by the attacker tricking the user into make a particular request, usually via the attackers website.

Changing the code which makes the request from your site won't have any effect on the code running on the attacker's site.

You need to defend against XSS when generating the output from whatever url points to, not by controlling the input to it from your site.

Upvotes: 1

Related Questions