diff --git a/bskylink/package.json b/bskylink/package.json
index 5fdee206b4..21fe123aba 100644
--- a/bskylink/package.json
+++ b/bskylink/package.json
@@ -9,8 +9,10 @@
},
"dependencies": {
"@atproto/common": "^0.4.0",
+ "@types/escape-html": "^1.0.4",
"body-parser": "^1.20.2",
"cors": "^2.8.5",
+ "escape-html": "^1.0.3",
"express": "^4.19.2",
"http-terminator": "^3.2.0",
"kysely": "^0.27.3",
diff --git a/bskylink/src/routes/redirect.ts b/bskylink/src/routes/redirect.ts
index b214ec638b..519fe52a0e 100644
--- a/bskylink/src/routes/redirect.ts
+++ b/bskylink/src/routes/redirect.ts
@@ -1,6 +1,7 @@
import assert from 'node:assert'
import {DAY, SECOND} from '@atproto/common'
+import escapeHTML from 'escape-html'
import {Express} from 'express'
import {AppContext} from '../context.js'
@@ -42,8 +43,10 @@ export default function (ctx: AppContext, app: Express) {
res.setHeader('Cache-Control', `max-age=${(7 * DAY) / SECOND}`)
res.type('html')
res.status(200)
+
+ const escaped = escapeHTML(url.href)
return res.send(
- ``,
+ ``,
)
}),
)
diff --git a/bskylink/yarn.lock b/bskylink/yarn.lock
index d2fa31456b..e72fea0b9b 100644
--- a/bskylink/yarn.lock
+++ b/bskylink/yarn.lock
@@ -69,6 +69,11 @@
dependencies:
"@types/node" "*"
+"@types/escape-html@^1.0.4":
+ version "1.0.4"
+ resolved "https://registry.yarnpkg.com/@types/escape-html/-/escape-html-1.0.4.tgz#dc7c166b76c7b03b27e32f80edf01d91eb5d9af2"
+ integrity sha512-qZ72SFTgUAZ5a7Tj6kf2SHLetiH5S6f8G5frB2SPQ3EyF02kxdyBFf4Tz4banE3xCgGnKgWLt//a6VuYHKYJTg==
+
"@types/node@*":
version "20.14.2"
resolved "https://registry.yarnpkg.com/@types/node/-/node-20.14.2.tgz#a5f4d2bcb4b6a87bffcaa717718c5a0f208f4a18"
@@ -276,7 +281,7 @@ es-errors@^1.3.0:
resolved "https://registry.yarnpkg.com/es-errors/-/es-errors-1.3.0.tgz#05f75a25dab98e4fb1dcd5e1472c0546d5057c8f"
integrity sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==
-escape-html@~1.0.3:
+escape-html@^1.0.3, escape-html@~1.0.3:
version "1.0.3"
resolved "https://registry.yarnpkg.com/escape-html/-/escape-html-1.0.3.tgz#0258eae4d3d0c0974de1c169188ef0051d1d1988"
integrity sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==