fix(error-response-plugin): sanitize input (#1141)

Author: chimurai

CHANGELOG.md

@@ -3,6 +3,7 @@
 ## next
 
 - fix(types): fix Logger type
+- fix(error-response-plugin): sanitize input
 
 ## [v3.0.5](https://github.com/chimurai/http-proxy-middleware/releases/tag/v3.0.5)
 

cspell.json

@@ -19,7 +19,7 @@
       "path": "CONTRIBUTORS.txt"
     }
   ],
-  "ignoreRegExpList": ["[a-z]+path", "\\]\\(#[a-z-]+\\)"],
+  "ignoreRegExpList": ["[a-z]+path", "\\]\\(#[a-z-]+\\)", "%[\\dA-Z]{2}"],
   "words": [
     "brotli",
     "camelcase",

src/plugins/default/error-response-plugin.ts

@@ -3,6 +3,7 @@ import type { Socket } from 'node:net';
 
 import { getStatusCode } from '../../status-code';
 import { Plugin } from '../../types';
+import { sanitize } from '../../utils/sanitize';
 
 function isResponseLike(obj: any): obj is http.ServerResponse {
   return obj && typeof obj.writeHead === 'function';
@@ -26,7 +27,7 @@ export const errorResponsePlugin: Plugin = (proxyServer, options) => {
       }
 
       const host = req.headers && req.headers.host;
-      res.end(`Error occurred while trying to proxy: ${host}${req.url}`);
+      res.end(`Error occurred while trying to proxy: ${sanitize(host)}${sanitize(req.url)}`);
     } else if (isSocketLike(res)) {
       res.destroy();
     }

src/utils/sanitize.ts

@@ -0,0 +1,3 @@
+export function sanitize(input: string | undefined): string {
+  return input?.replace(/[<>]/g, (i) => encodeURIComponent(i)) ?? '';
+}

test/unit/utils/sanitize.spec.ts

@@ -0,0 +1,17 @@
+import { sanitize } from '../../../src/utils/sanitize';
+
+describe('sanitize()', () => {
+  it('should return empty string for undefined input', () => {
+    expect(sanitize(undefined)).toEqual('');
+  });
+
+  it('should replace special characters with their HTML entity equivalents', () => {
+    const input = '<>';
+    expect(sanitize(input)).toMatchInlineSnapshot(`"%3C%3E"`);
+  });
+
+  it('should replace special characters with HTML entities', () => {
+    const input = '<script>alert("XSS")</script>';
+    expect(sanitize(input)).toMatchInlineSnapshot(`"%3Cscript%3Ealert("XSS")%3C/script%3E"`);
+  });
+});