html encode the reflected query parameters (#6680)

* html encode the reflected query parameters * fix lint issues
ampproject · Oct 6, 2023 · 1260410 · 1260410
1 parent e0bcb86
commit 1260410
Showing 1 changed file with 7 additions and 1 deletion.
diff --git a/netlify/functions/examples_api_cache_query/examples_api_cache_query.js b/netlify/functions/examples_api_cache_query/examples_api_cache_query.js
@@ -1,5 +1,11 @@
 const {STYLE} = require('../cache.js');
 
+const htmlEncode = (str) => {
+  return String(str).replace(/[^\w. ]/gi, (c) => {
+    return `&#${c.charCodeAt(0)};`;
+  });
+};
+
 const handler = async (ev) => {
   const queryString = JSON.stringify(ev.queryStringParameters, null, 2);
 
@@ -19,7 +25,7 @@ const handler = async (ev) => {
     <main>
       <h1>Hello World!</h1>
       <p>Query parameters:</p>
-      <pre>${queryString}</pre>
+      <pre>${htmlEncode(queryString)}</pre>
       <small>This document has been generated at: <date>${new Date()}</date></small>
     </main>
   </body>