From c06c25b0af75c6a94c7a22bfac8992470d529039 Mon Sep 17 00:00:00 2001
From: Henry <hzj94@hotmail.com>
Date: Sat, 9 Dec 2023 14:12:30 +0000
Subject: [PATCH] add sanitize html types

---
 packages/server/package.json     | 1 +
 packages/server/src/utils/XSS.ts | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/packages/server/package.json b/packages/server/package.json
index 013e6007..1eeb43f1 100644
--- a/packages/server/package.json
+++ b/packages/server/package.json
@@ -72,6 +72,7 @@
         "@types/cors": "^2.8.12",
         "@types/crypto-js": "^4.1.1",
         "@types/multer": "^1.4.7",
+        "@types/sanitize-html": "^2.9.5",
         "concurrently": "^7.1.0",
         "nodemon": "^2.0.15",
         "oclif": "^3",
diff --git a/packages/server/src/utils/XSS.ts b/packages/server/src/utils/XSS.ts
index 329c2ed2..3e96e6c8 100644
--- a/packages/server/src/utils/XSS.ts
+++ b/packages/server/src/utils/XSS.ts
@@ -1,12 +1,12 @@
 import { Request, Response, NextFunction } from 'express'
-const sanitizeHtml = require('sanitize-html')
+import sanitizeHtml from 'sanitize-html'
 
 export function sanitizeMiddleware(req: Request, res: Response, next: NextFunction): void {
     // decoding is necessary as the url is encoded by the browser
     const decodedURI = decodeURI(req.url)
     req.url = sanitizeHtml(decodedURI)
     for (let p in req.query) {
-        req.query[p] = sanitizeHtml(req.query[p])
+        req.query[p] = sanitizeHtml(req.query[p] as string)
     }
 
     next()