fix(security): Double escaping or unescaping

contributes to #669. to fix https://github.com/openwhyd/openwhyd/security/code-scanning/20
openwhyd · Aug 20, 2023 · ebc2781 · ebc2781
1 parent d28cdc1
commit ebc2781
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/app/controllers/api/bandcampExtractor.js b/app/controllers/api/bandcampExtractor.js
@@ -16,10 +16,10 @@ exports.extractBandcampStreamURLsFromHTML = (html) => {
 
 function htmlDecode(str) {
   return String(str)
-    .replace(/&amp;/g, '&')
     .replace(/&lt;/g, '<')
     .replace(/&gt;/g, '>')
-    .replace(/&quot;/g, '"');
+    .replace(/&quot;/g, '"')
+    .replace(/&amp;/g, '&');
 }
 
 exports.controller = async function (req, reqParams = {}, res) {