diff --git a/packages/server/src/sdk/app/rows/tests/utils.spec.ts b/packages/server/src/sdk/app/rows/tests/utils.spec.ts index cd25880a85..9b7711993e 100644 --- a/packages/server/src/sdk/app/rows/tests/utils.spec.ts +++ b/packages/server/src/sdk/app/rows/tests/utils.spec.ts @@ -354,7 +354,7 @@ describe("validate", () => { "1' OR '1' = '1", "' OR 'a' = 'a", "", - "\">", + '">', "", "
Hover over me!
", "'; EXEC sp_msforeachtable 'DROP TABLE ?'; --", @@ -362,14 +362,16 @@ describe("validate", () => { "UNION SELECT * FROM users", "INSERT INTO users (username, password) VALUES ('admin', 'password')", "/* This is a comment */ SELECT * FROM users", - "" - ])('test potentially unsafe input: %s', async input => { + '', + ])("test potentially unsafe input: %s", async input => { environment.XSS_SAFE_MODE = true const table = getTable() const row = { text: input } const output = await validate({ source: table, row }) expect(output.valid).toBe(false) - expect(output.errors).toBe(["Input not sanitised - potentially vulnerable to XSS"]) + expect(output.errors).toBe([ + "Input not sanitised - potentially vulnerable to XSS", + ]) environment.XSS_SAFE_MODE = false }) }) diff --git a/packages/server/src/sdk/app/rows/utils.ts b/packages/server/src/sdk/app/rows/utils.ts index 4c02889f8f..bded6a7a18 100644 --- a/packages/server/src/sdk/app/rows/utils.ts +++ b/packages/server/src/sdk/app/rows/utils.ts @@ -44,7 +44,8 @@ const SQL_CLIENT_SOURCE_MAP: Record = { [SourceName.BUDIBASE]: undefined, } -const XSS_INPUT_REGEX = /[<>;"'(){}]|--|\/\*|\*\/|union|select|insert|drop|delete|update|exec|script/i +const XSS_INPUT_REGEX = + /[<>;"'(){}]|--|\/\*|\*\/|union|select|insert|drop|delete|update|exec|script/i export function getSQLClient(datasource: Datasource): SqlClient { if (!isSQL(datasource)) { @@ -228,7 +229,9 @@ export async function validate({ if (env.XSS_SAFE_MODE && typeof row[fieldName] === "string") { if (XSS_INPUT_REGEX.test(row[fieldName])) { - errors[fieldName] = ['Input not sanitised - potentially vulnerable to XSS'] + errors[fieldName] = [ + "Input not sanitised - potentially vulnerable to XSS", + ] } }