Merge pull request #41 from MomHelpMe/fix/xss

xss 방지
MomHelpMe · Dec 30, 2024 · 98ba3f6 · 98ba3f6
2 parents 084a53a + 6a2bce6
commit 98ba3f6
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 2 deletions.
diff --git a/backend/users/models.py b/backend/users/models.py
@@ -9,8 +9,8 @@ class User(models.Model):
     ]
 
     user_id = models.IntegerField(primary_key=True)
-    nickname = models.CharField(max_length=255)
-    email = models.EmailField(max_length=255)
+    nickname = models.CharField(max_length=12)
+    email = models.EmailField(max_length=255 )
     img_url = models.URLField(blank=True)
     is_2FA = models.BooleanField(default=False)
     is_online = models.BooleanField(default=False)

diff --git a/backend/users/views.py b/backend/users/views.py
@@ -14,6 +14,7 @@
 from login.views import decode_jwt
 from drf_yasg.utils import swagger_auto_schema
 from game.onlineConsumers import OnlineConsumer
+from django.utils.html import escape
 
 
 class UserDetailView(APIView):
@@ -36,6 +37,8 @@ def put(self, request):
         # FIXME: is_online도 변경이 가능함 수정 필요
         serializer = UserSerializer(user, data=request.data, partial=True)
         if serializer.is_valid():
+            serializer.validated_data['nickname'] = escape(serializer.validated_data['nickname'])
+            serializer.validated_data['img_url'] = escape(serializer.validated_data['img_url'])
             serializer.save()
             return JsonResponse(serializer.data)
         return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)