Improve web-page templating sanitization. #188

New issue

Closed

opened 2025-10-16 05:54:42 -04:00 by rainbownapkin · 1 comment

rainbownapkin commented

2025-10-16 05:54:42 -04:00

Owner

Current EJS templates rely on input sanitization keep them safe. While we do trust the server to sanitize data before ingesting it, especially in cases in-which the data is saved to the DB, it would be safer to ensure we safely inject the data into the template no matter what.

We should replace uses of the <%- with the <%= tag where possible, un-escaping HTML entities before-hand to ensure sanitized data displays properly, as <%= expects unsafe data using validator.unescape(). This falls in-line with our method of injecting data on the client-side using JS, in which data is un-escaped with utils.ux.unescape() and injected safely using the node.innerText property.

Current EJS templates rely on input sanitization keep them safe. While we *do* trust the server to sanitize data before ingesting it, especially in cases in-which the data is saved to the DB, it would be safer to ensure we safely inject the data into the template no matter what. We should replace uses of the `<%-` with the `<%=` tag where possible, un-escaping HTML entities before-hand to ensure sanitized data displays properly, as `<%=` expects unsafe data using `validator.unescape()`. This falls in-line with our method of injecting data on the client-side using JS, in which data is un-escaped with `utils.ux.unescape()` and injected safely using the `node.innerText` property.