From 236bbe66bf65bc2335366ecba1fb26a208a41875 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Tue, 25 Aug 2026 13:42:56 +0000
Subject: [PATCH] bug: escape stored todo content to fix stored XSS in index
 view

---
 app.js          | 5 -----
 views/index.ejs | 2 +-
 2 files changed, 1 insertion(+), 6 deletions(-)

diff --git a/app.js b/app.js
index e7dfa39ffde..e4a9e946ae5 100644
--- a/app.js
+++ b/app.js
@@ -18,7 +18,6 @@ var methodOverride = require('method-override');
 var logger = require('morgan');
 var errorHandler = require('errorhandler');
 var optional = require('optional');
-var marked = require('marked');
 var fileUpload = require('express-fileupload');
 var dust = require('dustjs-linkedin');
 var dustHelpers = require('dustjs-helpers');
@@ -71,10 +70,6 @@ app.use('/users', routesUsers)
 // Static
 app.use(st({ path: './public', url: '/public' }));
 
-// Add the option to output (sanitized!) markdown
-marked.setOptions({ sanitize: true });
-app.locals.marked = marked;
-
 // development only
 if (app.get('env') == 'development') {
   app.use(errorHandler());
diff --git a/views/index.ejs b/views/index.ejs
index fef7c6c3ad4..2835bec53bc 100644
--- a/views/index.ejs
+++ b/views/index.ejs
@@ -17,7 +17,7 @@ strong {font-weight: bold}
 
 <% todos.forEach( function ( todo ){ %>
   <div class="item">
-    <a class="update-link" href="/edit/<%= todo._id %>" title="Update this todo item"><%- marked(new String(todo.content)) %></a>
+    <a class="update-link" href="/edit/<%= todo._id %>" title="Update this todo item"><%= todo.content %></a>
     <a class="del-btn" href="/destroy/<%= todo._id %>" title="Delete this todo item">Delete</a>
   </div>
 <% }); %>