Merge pull request #804 from solid/fix/escape-error

Send errors as plain text

Author: RubenVerborgh

lib/handlers/error-pages.js

@@ -95,6 +95,7 @@ function setAuthenticateHeader (req, res, err) {
  */
 function sendErrorResponse (statusCode, res, err) {
   res.status(statusCode)
+  res.header('Content-Type', 'text/plain;charset=utf-8')
   res.send(err.message + '\n')
 }
 

test/unit/error-pages-test.js

@@ -28,13 +28,14 @@ describe('handlers/error-pages', () => {
     it('defaults to status code 500 if none is specified in the error', () => {
       let ldp = { noErrorPages: true }
       let req = { app: { locals: { ldp } } }
-      let res = { status: sinon.stub(), send: sinon.stub() }
+      let res = { status: sinon.stub(), send: sinon.stub(), header: sinon.stub() }
       let err = { message: 'Unspecified error' }
       let next = {}
 
       errorPages.handler(err, req, res, next)
 
       expect(res.status).to.have.been.calledWith(500)
+      expect(res.header).to.have.been.calledWith('Content-Type', 'text/plain;charset=utf-8')
       expect(res.send).to.have.been.calledWith('Unspecified error\n')
     })
   })
@@ -47,12 +48,14 @@ describe('handlers/error-pages', () => {
       }
       let res = {
         status: sinon.stub(),
+        header: sinon.stub(),
         send: sinon.stub()
       }
 
       errorPages.sendErrorResponse(statusCode, res, error)
 
       expect(res.status).to.have.been.calledWith(404)
+      expect(res.header).to.have.been.calledWith('Content-Type', 'text/plain;charset=utf-8')
       expect(res.send).to.have.been.calledWith('Error description\n')
     })
   })
@@ -78,6 +81,7 @@ describe('handlers/error-pages', () => {
       let statusCode = 400
       let res = {
         status: sinon.stub(),
+        header: sinon.stub(),
         send: sinon.stub()
       }
       let err = { message: 'Error description' }
@@ -86,6 +90,7 @@ describe('handlers/error-pages', () => {
       return errorPages.sendErrorPage(statusCode, res, err, ldp)
         .then(() => {
           expect(res.status).to.have.been.calledWith(400)
+          expect(res.header).to.have.been.calledWith('Content-Type', 'text/plain;charset=utf-8')
           expect(res.send).to.have.been.calledWith('Error description\n')
         })
     })