Merge pull request FlowiseAI#1372 from FlowiseAI/bugfix/XSS-array-query

Bugfix/Sanitized &amp
hemati · Dec 12, 2023 · 65c4ecf · 65c4ecf
2 parents cff0618 + 3e6e0f9
commit 65c4ecf
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/packages/server/src/index.ts b/packages/server/src/index.ts
@@ -200,15 +200,15 @@ export class App {
 
         // Get component credential via name
         this.app.get('/api/v1/components-credentials/:name', (req: Request, res: Response) => {
-            if (!req.params.name.includes('&')) {
+            if (!req.params.name.includes('&amp;')) {
                 if (Object.prototype.hasOwnProperty.call(this.nodesPool.componentCredentials, req.params.name)) {
                     return res.json(this.nodesPool.componentCredentials[req.params.name])
                 } else {
                     throw new Error(`Credential ${req.params.name} not found`)
                 }
             } else {
                 const returnResponse = []
-                for (const name of req.params.name.split('&')) {
+                for (const name of req.params.name.split('&amp;')) {
                     if (Object.prototype.hasOwnProperty.call(this.nodesPool.componentCredentials, name)) {
                         returnResponse.push(this.nodesPool.componentCredentials[name])
                     } else {