fix: escape msg in render restricted error html, backport (#12889) (#12892)

patak-cat · web-flow · commit b48ac2a61891 · 2023-04-18T11:32:25.000+02:00
diff --git a/packages/vite/package.json b/packages/vite/package.json
@@ -78,6 +78,7 @@
     "@rollup/plugin-node-resolve": "14.1.0",
     "@rollup/plugin-typescript": "^8.5.0",
     "@rollup/pluginutils": "^4.2.1",
+    "@types/escape-html": "^1.0.0",
     "acorn": "^8.8.1",
     "acorn-walk": "^8.2.0",
     "cac": "^6.7.14",
@@ -92,6 +93,7 @@
     "dotenv": "^14.3.2",
     "dotenv-expand": "^5.1.0",
     "es-module-lexer": "^1.1.0",
+    "escape-html": "^1.0.3",
     "estree-walker": "^3.0.1",
     "etag": "^1.8.1",
     "fast-glob": "^3.2.12",
diff --git a/packages/vite/src/node/server/middlewares/static.ts b/packages/vite/src/node/server/middlewares/static.ts
@@ -3,6 +3,7 @@ import type { OutgoingHttpHeaders, ServerResponse } from 'node:http'
 import type { Options } from 'sirv'
 import sirv from 'sirv'
 import type { Connect } from 'dep-types/connect'
+import escapeHtml from 'escape-html'
 import type { ViteDevServer } from '../..'
 import { FS_PREFIX } from '../../constants'
 import {
@@ -208,7 +209,7 @@ function renderRestrictedErrorHTML(msg: string): string {
   return html`
     <body>
       <h1>403 Restricted</h1>
-      <p>${msg.replace(/\n/g, '<br/>')}</p>
+      <p>${escapeHtml(msg).replace(/\n/g, '<br/>')}</p>
       <style>
         body {
           padding: 1em 2em;
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
