Author: Andy Green <andy@warmcat.com>
Date: Fri Mar 27 12:13:29 2026 +0000

sanitation review


diff --git a/assets/gs/lwsgs.js b/assets/gs/lwsgs.js
index b3ae489..a5601f0 100644
--- a/assets/gs/lwsgs.js
+++ b/assets/gs/lwsgs.js
@@ -187,10 +187,17 @@ if (lwsgs_user.substring(0, 1) == "$") {
 }
 function lwsgs_san(s)
 {
-	if (s.search("<") != -1)
-		return "invalid string";
-	
-	return s;
+	var table = {
+		'<': 'lt',
+		'>': 'gt',
+		'"': 'quot',
+		'\'': 'apos',
+		'&': 'amp'
+	};
+
+	return s.toString().replace(/[<>"'&]/g, function(chr) {
+		return '&' + table[chr] + ';';
+	});
 }
 
 function lwsgs_update()
diff --git a/assets/sai.js b/assets/sai.js
index 58276b4..3ea092c 100644
--- a/assets/sai.js
+++ b/assets/sai.js
@@ -532,10 +532,17 @@ function expiry()
 
 function san(s)
 {
-	if (s.search("<") !== -1)
-		return "invalid string";
+	var table = {
+		'<': 'lt',
+		'>': 'gt',
+		'"': 'quot',
+		'\'': 'apos',
+		'&': 'amp'
+	};
 
-	return s;
+	return s.toString().replace(/[<>"'&]/g, function(chr) {
+		return '&' + table[chr] + ';';
+	});
 }
 
 function humanize(s)
@@ -1286,7 +1293,7 @@ function createBuilderDiv(plat) {
 		     `<div class="res-bar"><div class="res-bar-inner res-bar-ram w-0"></div></div>` +
 		     `<div class="res-bar"><div class="res-bar-inner res-bar-disk w-0"></div></div>` +
 		     `</div>`;
-	innerHTML += `${plat.peer_ip}` + "  " + plat.stay_on;
+	innerHTML += `${hsanitize(plat.peer_ip)}` + "  " + hsanitize(plat.stay_on);
 	innerHTML +=  `</td></tr></tbody></table>`;
 
 	platDiv.innerHTML = innerHTML;
diff --git a/src/server/s-notification.c b/src/server/s-notification.c
index 41ca405..7b8f279 100644
--- a/src/server/s-notification.c
+++ b/src/server/s-notification.c
@@ -975,11 +975,13 @@ sai_notification_file_upload_cb(void *data, const char *name,
 
 		{
 			uint64_t rid = 0;
-			char qu[192];
+			char qu[192], esc_hash[96];
+
+			lws_sql_purify(esc_hash, pss->sn.e.hash, sizeof(esc_hash));
 
 			lws_snprintf(qu, sizeof(qu), "select rowid from events "
 						     "where hash='%s'",
-						     pss->sn.e.hash);
+						     esc_hash);
 
 			if (sqlite3_exec(pss->vhd->server.pdb, qu,
 					 sai_sql3_get_uint64_cb,