search

Decicus / DecAPI

API provider/proxy that provides plaintext responses - Documentation: https://docs.decapi.me/
https://decapi.me/
MIT License
118 stars 23 forks source link

followage able to be exploited to spam channel #42

Closed akron-twitch closed 5 years ago

akron-twitch commented 5 years ago

hello i hope this is the place i'm supposed to post this, i was directed here by streamlabs discord. they said it wasn't a problem with the bot. i have found that the followage can be exploited to spam channels. its bad. if you include any punctuation in a username it spams the channel. example in my channel a user accidentally did !followage user.name and it spammed the channel. then all the other viewers saw it spams and started doing it too until i had to disconnect my bot.

i have this is my response in streamlabs chatbot: $tousername, you have been following $mychannel for $readapi(https://decapi.me/twitch/followage/$mychannel/$touserid?precision=3).

then viewer does !followage user.name

and it shows htis:

: <html>
: <head>
: <meta charset="utf-8">
: <link rel="stylesheet" href="/css/bootstrap.min.css" type="text/css" />
: <link rel="stylesheet" href="/css/darkly.css" type="text/css" />
: <link rel="stylesheet" href="https://use.fontawesome.com/releases/v5.1.1/css/all.css" integrity="sha384-O8whS3fhG2OnA5Kas0Y9l3cfpmYjapjI0E4theH4iuMD+pLhbf6JI0jIMfYcK3yZ" crossorigin="anonymous">
: <link
 input : rel="stylesheet" href="/css/custom.css" type="text/css" .

can you fix this, i really like this command. thank you!!!!

Decicus commented 5 years ago

This is technically an issue with Streamlabs Chatbot, since it for some reason decides it's a good idea to just post everything returned by $readapi() regardless of length (other bots like Nightbot doesn't once it reaches 400+ characters).

Anyways, I'll push a fix shortly. It's technically caused by a temporary fix that has lasted longer than "temporary".