RomanNum3ral
/
vert
mirror of https://github.com/VERT-sh/VERT.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix: strange xss vulnerability in theme cookie

This commit is contained in:
not-nullptr 2024-11-14 09:05:37 +00:00
parent 2880d9bf8c
commit 592bd1c1d9
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/hooks.server.ts
View File

@ -1,7 +1,14 @@
import type { Handle } from "@sveltejs/kit"; import type { Handle } from "@sveltejs/kit";
export const handle: Handle = async ({ event, resolve }) => { export const handle: Handle = async ({ event, resolve }) => {
const theme = event.cookies.get("theme") ?? ""; let theme = event.cookies.get("theme") ?? "";
if (theme !== "dark" && theme !== "light") {
event.cookies.set("theme", "", {
path: "/",
sameSite: "strict",
});
theme = "";
}
const res = await resolve(event, { const res = await resolve(event, {
transformPageChunk: ({ html }) => html.replace("%theme%", theme), transformPageChunk: ({ html }) => html.replace("%theme%", theme),
}); });