title: socket.io has xss vulnerability? How to solve this?
body: <p>I believe socket.io has a XSS vulnerability and I am wondering how to solve this.</p>
  
  <p>See my post about <a href="https://stackoverflow.com/questions/4441798/how-to-use-redis-publish-subscribe-with-nodejs-by-event-driven/4446424#4446424">pubsub redis with socket.io</a> which has a/the XSS hole.</p>
  
  <p>from redis-cli when you do:</p>
  
  <pre><code>publish pubsub "&lt;script&gt;alert('Hello world!');&lt;/script&gt;"
  </code></pre>
  
  <p>You will see an alert dialog with <code>Hello world!</code> which is <strong>BAD...</strong></p>
  
  <p>To solve this I copied the following snippet from visionmedia's jade library and wondering if this is enough?</p>
  
  <pre><code>/**
   * Escape the given string of `html`.
   *
   * @param {String} html
   * @return {String}
   * @api private
   */
  
  function sanitize(html){
      return String(html)
          .replace(/&amp;(?!\w+;)/g, '&amp;amp;')
          .replace(/&lt;/g, '&amp;lt;')
          .replace(/&gt;/g, '&amp;gt;')
          .replace(/"/g, '&amp;quot;');
  }
  </code></pre>
  
  <p>Is this enough or am I missing something? Maybe even inside socket.js to solve the problem?</p>