XSS: replacing deprecated sanitize-js with sanitize-html

packages/server/src/utils/XSS.ts

@@ -1,10 +1,12 @@
 import { Request, Response, NextFunction } from 'express'
-let stripJs = require('strip-js')
+const sanitizeHtml = require('sanitize-html')
 
 export function sanitizeMiddleware(req: Request, res: Response, next: NextFunction): void {
-    req.url = stripJs(req.url)
+    // decoding is necessary as the url is encoded by the browser
+    const decodedURI = decodeURI(req.url)
+    req.url = sanitizeHtml(decodedURI)
     for (let p in req.query) {
-        req.query[p] = stripJs(req.query[p])
+        req.query[p] = sanitizeHtml(req.query[p])
     }
 
     next()