浏览代码

security: address 7018641

KernelDeimos 11 月之前
父节点
当前提交
eb17d61fc1
共有 1 个文件被更改,包括 4 次插入1 次删除
  1. 4 1
      packages/backend/src/services/PuterHomepageService.js

+ 4 - 1
packages/backend/src/services/PuterHomepageService.js

@@ -295,6 +295,7 @@ class PuterHomepageService extends BaseService {
     };
     
     generate_error_html ({ message }) {
+        const { encode } = require('html-entities');
         return `
             <!DOCTYPE html>
             <html>
@@ -320,7 +321,9 @@ class PuterHomepageService extends BaseService {
                     </style>
                 </head>
                 <body>
-                    <h1>${message}</h1>
+                    <h1>${
+                        encode(message, { mode: 'nonAsciiPrintable' })
+                    }</h1>
                 </body>
             </html>
         `;