add validators to sanitize parameters

packages/remark-lsx/src/server/index.ts

@@ -1,17 +1,49 @@
 import type { Request, Response } from 'express';
+import { query } from 'express-validator';
+
+import type { LsxApiOptions } from '../interfaces/api';
 
 import { listPages } from './routes/list-pages';
 
+
 const loginRequiredFallback = (req: Request, res: Response) => {
   return res.status(403).send('login required');
 };
 
+const escapeSpecialCharacters = (text: string): string => {
+  return text
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#039;');
+};
+
+const lsxValidator = [
+  query('options')
+    .customSanitizer((options) => {
+      try {
+        const jsonData: LsxApiOptions = JSON.parse(options);
+
+        Object.keys(jsonData).forEach((key) => {
+          jsonData[key] = escapeSpecialCharacters(jsonData[key]);
+        });
+
+        return jsonData;
+      }
+      catch (err) {
+        throw new Error('Invalid JSON format in options');
+      }
+    }),
+];
+
 // eslint-disable-next-line @typescript-eslint/explicit-module-boundary-types, @typescript-eslint/no-explicit-any
 const middleware = (crowi: any, app: any): void => {
   const loginRequired = crowi.require('../middlewares/login-required')(crowi, true, loginRequiredFallback);
   const accessTokenParser = crowi.require('../middlewares/access-token-parser')(crowi);
 
-  app.get('/_api/lsx', accessTokenParser, loginRequired, listPages);
+  // app.get('/_api/lsx', accessTokenParser, loginRequired, listPages);
+  app.get('/_api/lsx', accessTokenParser, loginRequired, lsxValidator, listPages);
 };
 
 export default middleware;

packages/remark-lsx/src/server/routes/list-pages/index.ts

@@ -69,7 +69,7 @@ export const listPages = async(req: Request & { user: IUser }, res: Response): P
     pagePath: removeTrailingSlash(req.query.pagePath.toString()),
     offset: req.query?.offset != null ? Number(req.query.offset) : undefined,
     limit: req.query?.limit != null ? Number(req.query?.limit) : undefined,
-    options: req.query?.options != null ? JSON.parse(req.query.options.toString()) : {},
+    options: req.query?.options != null ? JSON.parse(JSON.stringify(req.query.options)) : {},
   };
 
   const {