From f7bb5969cfbccf85ba36ceae9bed3021120d95b7 Mon Sep 17 00:00:00 2001
From: Jade <hmy940118@gmail.com>
Date: Tue, 1 Jun 2021 12:34:24 +0800
Subject: [PATCH] :bug: Filter XSS injection (#31)

---
 .gitignore                 | 1 +
 public/file-repository.php | 4 ++++
 public/pdo-repository.php  | 4 ++++
 3 files changed, 9 insertions(+)

diff --git a/.gitignore b/.gitignore
index 3d5163b..22e3ec9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,3 @@
 /vendor/
 .env
+.idea/
diff --git a/public/file-repository.php b/public/file-repository.php
index fb09898..7ebc769 100644
--- a/public/file-repository.php
+++ b/public/file-repository.php
@@ -38,6 +38,10 @@ try {
         $storagePath = $_ENV['FILE_STORAGE_PATH'];
     }
 
+    array_walk_recursive($_GET, function (&$input) {
+        $input = htmlspecialchars($input, ENT_NOQUOTES, 'UTF-8', false);
+    });
+
     $badgeLabel = $_GET['label'] ?? 'Profile views';
     $badgeMessageBackgroundFill = $_GET['color'] ?? 'blue';
     $badgeStyle = $_GET['style'] ?? 'flat';
diff --git a/public/pdo-repository.php b/public/pdo-repository.php
index 895c0de..4d22555 100644
--- a/public/pdo-repository.php
+++ b/public/pdo-repository.php
@@ -42,6 +42,10 @@ try {
 
     $httpUserAgent = $_SERVER['HTTP_USER_AGENT'] ?? '';
 
+    array_walk_recursive($_GET, function (&$input) {
+        $input = htmlspecialchars($input, ENT_NOQUOTES, 'UTF-8', false);
+    });
+
     $badgeLabel = $_GET['label'] ?? 'Profile views';
     $badgeMessageBackgroundFill = $_GET['color'] ?? 'blue';
     $badgeStyle = $_GET['style'] ?? 'flat';