use template literals and escape-html to do XML construction

auth0 · Jan 16, 2020 · a61394d · a61394d
1 parent bf19c00
commit a61394d
Show file tree

Hide file tree

Showing 5 changed files with 20 additions and 17 deletions.
diff --git a/lib/templates/encrypted-key.tpl.xml.js b/lib/templates/encrypted-key.tpl.xml.js
@@ -1,9 +1,11 @@
-module.exports = `
+var escapehtml = require('escape-html');
+
+module.exports = ({ contentEncryptionMethod, keyInfo, encryptedContent }) => `
 <xenc:EncryptedData Type="http://www.w3.org/2001/04/xmlenc#Element" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
-  <xenc:EncryptionMethod Algorithm="<%= contentEncryptionMethod %>" />
-  <%- keyInfo %>
+  <xenc:EncryptionMethod Algorithm="${escapehtml(contentEncryptionMethod)}" />
+  ${keyInfo}
   <xenc:CipherData>
-    <xenc:CipherValue><%= encryptedContent %></xenc:CipherValue>
+    <xenc:CipherValue>${escapehtml(encryptedContent)}</xenc:CipherValue>
   </xenc:CipherData>
 </xenc:EncryptedData>
 `;

diff --git a/lib/templates/keyinfo.tpl.xml.js b/lib/templates/keyinfo.tpl.xml.js
@@ -1,14 +1,16 @@
-module.exports = `
+var escapehtml = require('escape-html');
+
+module.exports = ({ encryptionPublicCert, encryptedKey, keyEncryptionMethod }) => `
 <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
   <e:EncryptedKey xmlns:e="http://www.w3.org/2001/04/xmlenc#">
-    <e:EncryptionMethod Algorithm="<%= keyEncryptionMethod %>">
+    <e:EncryptionMethod Algorithm="${escapehtml(keyEncryptionMethod)}">
       <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
     </e:EncryptionMethod>
     <KeyInfo>
-      <%- encryptionPublicCert %>
+      ${encryptionPublicCert}
     </KeyInfo>
     <e:CipherData>
-      <e:CipherValue><%= encryptedKey %></e:CipherValue>
+      <e:CipherValue>${escapehtml(encryptedKey)}</e:CipherValue>
     </e:CipherData>
   </e:EncryptedKey>
 </KeyInfo>

diff --git a/lib/utils.js b/lib/utils.js
@@ -1,5 +1,4 @@
-var ejs = require('ejs'),
-    path = require('path'),
+var path = require('path'),
     fs = require('fs');
 
 var templates = {
@@ -8,7 +7,7 @@ var templates = {
 };
 
 function renderTemplate (file, data) {
-  return ejs.render(templates[file], data);
+  return templates[file](data);
 }
 
 function pemToCert(pem) {

diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -19,7 +19,7 @@
   ],
   "license": "MIT",
   "dependencies": {
-    "ejs": "^2.5.6",
+    "escape-html": "^1.0.3",
     "node-forge": "^0.7.0",
     "xmldom": "~0.1.15",
     "xpath": "0.0.27"