Sanitize query input

blockscout · Mar 29, 2024 · 050aac3 · 050aac3
1 parent 60c0554
commit 050aac3
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 2 deletions.
diff --git a/lib/absinthe/plug/graphiql.ex b/lib/absinthe/plug/graphiql.ex
@@ -473,4 +473,11 @@ defmodule Absinthe.Plug.GraphiQL do
   defp normalize_socket_url(%{socket_url: url} = config, _) do
     %{config | socket_url: "'#{url}'"}
   end
+
+  defp sanitize(input) do
+    input
+    |> to_string()
+    |> Plug.HTML.html_escape()
+    |> String.replace("&quot;", "\"")
+  end
 end
diff --git a/lib/absinthe/plug/graphiql/graphiql.html.eex b/lib/absinthe/plug/graphiql/graphiql.html.eex
@@ -90,7 +90,7 @@ add "&raw" to the end of the URL within a browser.
         fetcher,
         onEditQuery: onEditQuery,
         onEditVariables: onEditVariables,
-        query: '<%= query_string %>',
+        query: '<%= sanitize(query_string) %>',
         response: '<%= result_string %>',
         variables: '<%= variables_string %>',
       }),

diff --git a/lib/absinthe/plug/graphiql/graphiql_workspace.html.eex b/lib/absinthe/plug/graphiql/graphiql_workspace.html.eex
@@ -49,7 +49,7 @@ add "&raw" to the end of the URL within a browser.
         defaultWebsocketUrl: <%= socket_url %>,
         subscriptionsClientBuilder: absintheSubscriptionsClientBuilder,
       <% end %>
-      defaultQuery: '<%= query_string %>',
+      defaultQuery: '<%= sanitize(query_string) %>',
       defaultVariables: '<%= variables_string %>',
       defaultHeaders: <%= default_headers %>
     });