fix: XSS Vulnerability (#17)

Resolves #1 Reviewed-on: #17
2026-04-03 13:09:45 +02:00
parent 2e16cf9d51
commit 239bf163e8
4 changed files with 52 additions and 0 deletions
@@ -7,6 +7,7 @@ import { ensureAuth } from '$lib/auth';
 import { extractFormData } from '$lib/extractFormData';
 import * as v from 'valibot';
 import { resolve } from '$app/paths';
+import sanitizeHtml from 'sanitize-html';

 export const load: PageServerLoad = async (event) => {
 	const akti = await db.query.aktis.findFirst({
@@ -56,6 +57,8 @@ export const actions = {

 		if (!changeRequest) return error(400);

+		changeRequest.body = sanitizeHtml(changeRequest.body);
+
 		await db
 			.update(aktis)
 			.set({ ...changeRequest, version: akti[0].version + 1 })