[Noalyss-commit] [noalyss] 31/38: DB protect against JS Injection

[dwm]

sparkyx pushed a commit to branch devel
in repository noalyss.

commit ae83ccbda35b8c9aca3b123dd196b2cc67ec9289
Author: Dany wm <danydb@noalyss.eu>
AuthorDate: Thu Feb 15 20:59:31 2024 +0100

    DB protect against JS Injection
---
 sql/upgrade.sql | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/sql/upgrade.sql b/sql/upgrade.sql
index e69de29bb..38c2e620c 100644
--- a/sql/upgrade.sql
+++ b/sql/upgrade.sql
@@ -0,0 +1,23 @@
+CREATE OR REPLACE FUNCTION comptaproc.trg_remove_script_tag()
+    RETURNS trigger
+    LANGUAGE plpgsql
+AS $function$
+
+begin
+
+    NEW.agc_comment_raw:= regexp_replace(NEW.agc_comment_raw, '<script', 
'scritp', 'i');
+    return NEW;
+
+end;
+$function$
+;
+
+
+create trigger t_remove_script_tag before
+    insert
+    or
+    update
+    on
+        public.action_gestion_comment for each row execute function 
comptaproc.trg_remove_script_tag();
+
+