Remove naive XSS protection as there is no risk to IndexedDB and risk at RPC server...

diff --git a/src/lib/rolodex.ts b/src/lib/rolodex.ts
index 4437e38cb9093ac56a508da57ada499486fb9b91..3e690e8055ca767cbc091a1860ea7a7b3fa010ec 100644 (file)
--- a/src/lib/rolodex.ts
+++ b/src/lib/rolodex.ts
@@ -43,11 +43,6 @@ export class Rolodex {
                if (typeof address !== 'string') {
                        throw new Error('Address must be a string for rolodex entries')
                }
-               name = name
-                       .replaceAll('/', '\\u002f')
-                       .replaceAll('<', '\\u003c')
-                       .replaceAll('>', '\\u003e')
-                       .replaceAll('\\', '\\u005c')
                const account = new Account(address)
 
                try {
@@ -145,6 +140,8 @@ export class Rolodex {
        /**
         * Gets all names stored in the rolodex.
         *
+        * Be sure to sanitize names before displaying in HTML to prevent XSS.
+        *
         * @returns {Promise<string[]>} Promise for a list of all names stored in the rolodex
         */
        static async getAllNames (): Promise<string[]> {
@@ -160,6 +157,8 @@ export class Rolodex {
        /**
         * Gets the name associated with a specific Nano address from the rolodex.
         *
+        * Be sure to sanitize names before displaying in HTML to prevent XSS.
+        *
         * @param {string} address - Nano account address
         * @returns {Promise<string|null>} Promise for the name associated with the address, or null if not found
         */
@@ -180,7 +179,7 @@ export class Rolodex {
         *
         * @param {string} name - Alias to look up
         * @param {string} signature - Signature to use for verification
-        * @param {string} data - Signed data to verify
+        * @param {string} data - UTF-8 string of signed data to verify
         * @returns {Promise<boolean>} True if the signature was used to sign the data, else false
         */
        static async verify (name: string, signature: string, data: string): Promise<boolean> {

diff --git a/src/lib/rpc.ts b/src/lib/rpc.ts
index 152efaab97db39427bf8c4e1dd601dc8efae1428..f2990026447f5ab9d31db46e3ad5e2327cf58d27 100644 (file)
--- a/src/lib/rpc.ts
+++ b/src/lib/rpc.ts
@@ -41,10 +41,6 @@ export class Rpc {
                data ??= {}
                data.action = action.toLowerCase()
                const body = JSON.stringify(data)
-                       .replaceAll('/', '\\u002f')
-                       .replaceAll('<', '\\u003c')
-                       .replaceAll('>', '\\u003e')
-                       .replaceAll('\\', '\\u005c')
 
                const aborter = new AbortController()
                const req = new Request(this.#u, {