Mitigate XSS by sending fetched content as plain text and enforcing a strict Content Security Policy in /fetch endpoint.

[zeropath-ai-dev]

front end vuln:
Detected directly writing to a Response object from user-defined input. This can bypass HTML escaping and may expose your application to a Cross-Site-scripting (XSS) vulnerability.

Vulnerability description: Detected directly writing to a Response object from user-defined input. This bypasses any HTML escaping and may expose your application to a Cross-Site-scripting (XSS) vulnerability. Instead, use 'resp.render()' to render safely escaped HTML.

Vulnerability language: JavaScript (Node.js/Express)

Patch details:

• In the /fetch endpoint, the response content (from axios) was previously sent to the client via res.send(resp.data) without any sanitization or escaping, creating a risk that untrusted content from a remote source could result in a reflected XSS attack.
• The patch addresses this by:
  • Explicitly setting the Content-Type to "text/plain" with res.type('text/plain'), ensuring the browser does not interpret the response as HTML, thus preventing script execution even if JavaScript appears in the response.
  • Enforcing a strict Content-Security-Policy header (default-src 'none'; script-src 'none'; object-src 'none';) to further prevent the execution of scripts or loading of other resources, providing defense in depth.

Summary of changes:

• Added res.set('Content-Security-Policy', ...) to strictly block script and object execution.
• Changed response type with res.type('text/plain') to mitigate XSS vectors.
• Continued to send the fetched content as plain text, but now with additional protections against XSS.

Testing & validation:

• Manually tested the /fetch endpoint to confirm that fetched remote content is now rendered as plain text.
• Verified that potentially executable content does not trigger in the browser.
• Confirmed that the Content-Security-Policy header is set in the HTTP response.
• Application functionality (fetching remote content) is preserved while blocking XSS attack vectors.

Please review for correctness and adherence to security best practices.