🎨 La regex bloque les script html

MTES-MCT · Sep 19, 2024 · 235dac9 · 235dac9
1 parent 930b13f
commit 235dac9
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 6 deletions.
diff --git a/packages/applications/legacy/src/controllers/userAccount/postSignup.ts b/packages/applications/legacy/src/controllers/userAccount/postSignup.ts
@@ -6,15 +6,16 @@ import { addQueryParams } from '../../helpers/addQueryParams';
 import * as yup from 'yup';
 import safeAsyncHandler from '../helpers/safeAsyncHandler';
 import { EmailAlreadyUsedError } from '../../modules/shared';
+
 const schema = yup.object({
   body: yup.object({
     firstname: yup
       .string()
-      .matches(/^[A-Za-z]+$/, 'Ce champ ne doit contenir que des lettres')
+      .matches(/^(?!.*<.*?>).*$/, 'Ce champ ne doit pas contenir de balises HTML')
       .required('Ce champ est obligatoire'),
     lastname: yup
       .string()
-      .matches(/^[A-Za-z]+$/, 'Ce champ ne doit contenir que des lettres')
+      .matches(/^(?!.*<.*?>).*$/, 'Ce champ ne doit pas contenir de balises HTML')
       .required('Ce champ est obligatoire'),
     email: yup
       .string()

diff --git a/packages/applications/legacy/src/views/pages/Signup.tsx b/packages/applications/legacy/src/views/pages/Signup.tsx
@@ -88,8 +88,8 @@ const SignupForm = ({ utilisateurInvité, email, error }: SignupFormProps) => (
             type="text"
             id="firstname"
             name="firstname"
-            pattern="^[A-Za-z]*"
-            title="Ce champ ne peut contenir que des lettres"
+            pattern="^(?!.*<.*?>).+$"
+            title="Ce champ ne doit pas contenir de balises HTML"
             required
           />
         </div>
@@ -101,8 +101,8 @@ const SignupForm = ({ utilisateurInvité, email, error }: SignupFormProps) => (
             type="text"
             id="lastname"
             name="lastname"
-            pattern="^[a-zA-Z]*"
-            title="Ce champ ne peut contenir que des lettres"
+            pattern="^(?!.*<.*?>).+$"
+            title="Ce champ ne doit pas contenir de balises HTML"
             required
           />
         </div>