github/overleaf
1
0
Fork 0
mirror of https://github.com/overleaf/overleaf.git synced 2024-11-21 20:47:08 -05:00
Code Issues Projects Releases Packages Wiki Activity

patched xss hole with messages not setting the content type correctly

Browse source
This commit is contained in:
Henry Oswald 2015-05-19 11:04:52 +01:00
parent 47d4ed9631
commit f5c39efcac
2 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
services/web/app/coffee/Features/Chat/ChatController.coffee
View file

@ -25,4 +25,5 @@ module.exports =
logger.err err:err, query:query, "problem getting messages from chat api"
return res.send 500
logger.log length:messages?.length, "sending messages to client"
res.set 'Content-Type', 'application/json'
res.send messages

4
services/web/test/UnitTests/coffee/Chat/ChatControllerTests.coffee
View file

@ -33,7 +33,8 @@ describe "ChatController", ->
_id:@user_id
body:
content:@messageContent
@res = {}
@res =
set:sinon.stub()
describe "sendMessage", ->
@ -69,6 +70,7 @@ describe "ChatController", ->
messages = [{content:"hello"}]
@ChatHandler.getMessages.callsArgWith(2, null, messages)
@res.send = (sentMessages)=>
@res.set.calledWith('Content-Type', 'application/json').should.equal true
sentMessages.should.deep.equal messages
done()
@ChatController.getMessages @req, @res