Untitled Lesson
Skill Matrix
UNLOCK NODES BY LEARNING NEW TAGS.
A username field should never contain any HTML markup. What is the safest sanitization approach for this kind of plain-text-only field?
💻 Code Challenge | +75 XP
Write a sanitizeComment(input) function using sanitize-html that allows only <b>, <i>, and <a href> tags, stripping everything else including event handler attributes.
A stored XSS vulnerability was found in a product review field that allows some HTML formatting. Reorder the steps to fix it correctly.
Task: Reorder the blocks in logical sequence to solve the problem.
A.D.A. Interface
Adaptive Didactic Assistant
Pascual Vila
Frontend Instructor // Code Syllabus
The Error //
Writing a custom regex to strip <script> tags as the sole XSS defense
// Wrong: bypassable, e.g. by "<scr<script>ipt>"
input.replace(/<script>.*?<\/script>/gi, "");
// Correct
sanitizeHtml(input, { allowedTags: [] });The Solution //
Hand-rolled regex-based tag stripping has a long, well-documented history of being bypassed through nested tags, malformed markup browsers still parse, and encoded payloads. Use a battle-tested library like sanitize-html with an explicit tag/attribute allowlist instead.
The Error //
Using a plain-text field's value directly in a file system path without sanitizing traversal sequences
// Wrong: vulnerable to "../../etc/passwd"-style traversal
const fullPath = path.join(UPLOAD_DIR, userFileName);
// Correct
const safeName = path.basename(userFileName);
const fullPath = path.join(UPLOAD_DIR, safeName);The Solution //
A filename supplied by a user (e.g. for a file upload) can contain "../" sequences that escape the intended directory when naively joined into a path — a path traversal vulnerability. Use path.basename() to strip directory components and verify the resolved path stays within the intended base directory.