fix: set httpOnly on JWT cookie and sanitize scriptJs to prevent stored XSS

server/helpers/common.js

@@ -45,6 +45,7 @@ module.exports = {
   getCookieOpts () {
     return {
       expires: DateTime.utc().plus({ days: 365 }).toJSDate(),
+      httpOnly: true,
       ...(WIKI.config.host.startsWith('https://') ? { secure: true } : {})
     }
   }

server/models/pages.js

@@ -292,7 +292,7 @@ module.exports = class Page extends Model {
       locale: opts.locale,
       path: opts.path
     })) {
-      scriptJs = opts.scriptJs || ''
+      scriptJs = opts.scriptJs ? opts.scriptJs.replace(/<script/gi, '') : ''
     }
 
     // -> Create page
@@ -419,7 +419,7 @@ module.exports = class Page extends Model {
       locale: opts.locale,
       path: opts.path
     })) {
-      scriptJs = opts.scriptJs || ''
+      scriptJs = opts.scriptJs ? opts.scriptJs.replace(/<script/gi, '') : ''
     }
 
     // -> Update page