Merge pull request from GHSA-gjg7-4j2h-94fq

Fix XSS in Open Graph & User metadata

1 files changed, 3 insertions, 2 deletions

diff --git a/lib/models/user.js b/lib/models/user.js
index 383be1a7..d7953003 100644
--- a/lib/models/user.js
+++ b/lib/models/user.js
@@ -2,6 +2,7 @@
 // external modules
 const Sequelize = require('sequelize')
 const scrypt = require('scrypt-kdf')
+const filterXSS = require('xss')
 
 // core
 const logger = require('../logger')
@@ -74,7 +75,7 @@ module.exports = function (sequelize, DataTypes) {
     }
     if (profile) {
       profile = {
-        name: profile.displayName || profile.username,
+        name: filterXSS(profile.displayName || profile.username),
         photo: User.parsePhotoByProfile(profile),
         biggerphoto: User.parsePhotoByProfile(profile, true)
       }
@@ -135,7 +136,7 @@ module.exports = function (sequelize, DataTypes) {
         photo = generateAvatarURL(profile.username)
         break
     }
-    return photo
+    return filterXSS(photo)
   }
   User.parseProfileByEmail = function (email) {
     return {