I would like to report HTML Injection in buttle module. Due to lack of filenames sanitization, it is possible to inject malicious ```iframe``` tag via filename and execute arbitray JavaScript code. # Module **module name:** buttle **version:** 0.2.0 **npm page:** https://www.npmjs.com/package/buttle ## Module Description Simple static file (+ markdown) server. ## Module Stats Stats: N/A, estimated ~20-40 downloads/week # Vulnerability ## Vulnerability Description When ```buttle``` displays directory index in the browser, it uses ```directory.js``` middleware from ```connect``` module to create an output with HTML. Because methods to escape user output used in this middleware are not sufficient enough (it's actually quite outdated version of ```connect```), it is possible to inject ```iframe``` tag with ```src``` attribute set to arbitrary HTML file, which can contain any executable JavaScript code. ## Steps To Reproduce: - install ```buttle```: ``` $ npm i buttle ``` - create file with the following name: ```">

Query Builder