Fix XSS

[alromh87]

There was a XSS vulnerabilty because of using innerHTML from user input making code injection available to malitious user.

I fixed by sanitizing user, message, image and by creating DOM elements instead

Message is added as plain text using .textContent, this way no text is lost in the chat.
Image is added seting src of img element
Image link is cleaned for javascript execution

Vulnerability can be tested by:

1. Start the server
2. Go on http://localhost:3000
3. Create clientPoc.js with following contet:

const
    io = require("socket.io-client"),
    ioClient = io.connect("http://localhost:3000/");

ioClient.on("system", (usr,_2,_3) => console.info('system: ', usr));
ioClient.on("newMsg", (usr,msg) => console.info(usr, msg));

ioClient.on('connect', () => {
   console.log('Conectado')
   ioClient.emit('login', 'testUser"><img/src="x"/onerror="alert(\'Login: Hello from console\')">')
   ioClient.emit('postMsg', 'testMesage"><img/src="x"/onerror="alert(\'Msg: Hello from console\')">')
   ioClient.emit('postMsg', '<script>alert("Msg script")</script>')
   ioClient.emit('postMsg', 'testMesage"><img/src="x"/onerror="alert(\'Image: Hello from console\')">[emoji:5] yeah!!')
   ioClient.emit('img', 'data:image/png;base64testMesage"><img/src="x"/onerror="alert(\'Msg: Hello from console\')">[emoji:5] yeah!!')
   ioClient.emit('img', 'javascript:alert(\'Img link: Hello again\')')
   ioClient.emit('img', 'javascript:jjavascript:ajavascript:vjavascript:ajavascript:sjavascript:cjavascript:rjavascript:ijavascript:pjavascript:t://test%0Aalert(1)')
});

4. execute clientPoc.js

node clientPoc.js

5. Multiple messages are show triggered by XSS

• Username XSS
  

• Mesage XSS
  

• Image XSS
  

6. click on image link

7. message is show in new page

• Image link XSS

After fix No code is executed for remote user, all cases are handled

After fix functionality is unafected, and any text can be sent without being lost