Shield: Add input sanitization and length validation to Contact form
Added `sanitizeInput` utility to escape HTML characters. Updated `Contact.tsx` to sanitize inputs before sending via `emailjs`. Added max length validation for Name (100), Subject (200), and Message (5000). Updated tests to cover sanitization and validation logic, including adding `cleanup()` to prevent test leakage.
This commit is contained in:
18
src/utils/security.ts
Normal file
18
src/utils/security.ts
Normal file
@@ -0,0 +1,18 @@
|
||||
/**
|
||||
* Sanitizes user input by encoding special HTML characters.
|
||||
* Prevents XSS attacks by ensuring input is treated as text, not HTML.
|
||||
*
|
||||
* @param input - The raw string input from the user.
|
||||
* @returns The sanitized string with special characters encoded.
|
||||
*/
|
||||
export function sanitizeInput(input: string): string {
|
||||
if (typeof input !== "string") {
|
||||
return input;
|
||||
}
|
||||
return input
|
||||
.replace(/&/g, "&")
|
||||
.replace(/</g, "<")
|
||||
.replace(/>/g, ">")
|
||||
.replace(/"/g, """)
|
||||
.replace(/'/g, "'");
|
||||
}
|
||||
Reference in New Issue
Block a user