From 796e46ae4080b5a7eb2b7fb60dd409fa52048385 Mon Sep 17 00:00:00 2001
From: Shakeel Bhat <shakeelurrehman.bhat@crowdstrike.com>
Date: Mon, 27 Jul 2026 22:27:22 +0530
Subject: [PATCH] fix: set httpOnly on JWT cookie and sanitize scriptJs to
 prevent stored XSS

---
 server/helpers/common.js | 1 +
 server/models/pages.js   | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/server/helpers/common.js b/server/helpers/common.js
index 21cd577da1..2b64175b60 100644
--- a/server/helpers/common.js
+++ b/server/helpers/common.js
@@ -45,6 +45,7 @@ module.exports = {
   getCookieOpts () {
     return {
       expires: DateTime.utc().plus({ days: 365 }).toJSDate(),
+      httpOnly: true,
       ...(WIKI.config.host.startsWith('https://') ? { secure: true } : {})
     }
   }
diff --git a/server/models/pages.js b/server/models/pages.js
index bb5b658512..dfb73406c6 100644
--- a/server/models/pages.js
+++ b/server/models/pages.js
@@ -292,7 +292,7 @@ module.exports = class Page extends Model {
       locale: opts.locale,
       path: opts.path
     })) {
-      scriptJs = opts.scriptJs || ''
+      scriptJs = opts.scriptJs ? opts.scriptJs.replace(/<script/gi, '') : ''
     }
 
     // -> Create page
@@ -419,7 +419,7 @@ module.exports = class Page extends Model {
       locale: opts.locale,
       path: opts.path
     })) {
-      scriptJs = opts.scriptJs || ''
+      scriptJs = opts.scriptJs ? opts.scriptJs.replace(/<script/gi, '') : ''
     }
 
     // -> Update page