Markdown text in the (nick)name does not get escaped

Dragory / modmailbot

Modmail Bot is a bot for Discord that makes it easier for users to contact moderators and admins for help.

MIT License

709 stars 704 forks source link

Markdown text in the (nick)name does not get escaped #235

Closed DarkView closed 5 years ago

DarkView commented 5 years ago

Having any markdown supported by discord in your (nick)name while using the bot will result in it showing up on the other side with it applied. For example, if you have ||Dark|| as your name, the mods name will be spoilered in the response the user gets and vice versa. Same works for all other markdown.

So with *Dark* as my nickname, the user would get this as a response: (Moderator) Dark: \<Text> This is a really big issue if you put ``` around your name, as it will put the name in the response as a codeblock

smooreace commented 5 years ago

Talk to Discord about stopping children from using stupid crap in their names!

On Wed, Mar 6, 2019 at 6:59 PM Nils Blömeke notifications@github.com wrote:

Having any markdown supported by discord in your (nick)name while using the bot will result in it showing up on the other side with it applied. For example, if you have ||Dark|| as your name, the mods name will be spoilered in the response the user gets and vice versa. Same works for all other markdown.

So with Dark as my nickname, the user would get this as a response: (Moderator) Dark: . This is a really big issue if you put ``` around your name, as it will put the name in the response as a codeblock

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/Dragory/modmailbot/issues/235, or mute the thread https://github.com/notifications/unsubscribe-auth/Ah5OQ7OjPLaP4dl7ic77p9GDkJVNILxgks5vUGRngaJpZM4biIZe .

DarkView commented 5 years ago

Talk to Discord about stopping children from using stupid crap in their names!

Seeing as the markdown characters are just regular characters, i dont see that happening. Why disallow stars or vertical bars in (nick)names?

smooreace commented 5 years ago

Do you realize that Discord came to be as a business tool, and is still very deeply entrenched in that realm as a collaboration?! Stars and sparkly BS in a name isn't professional and very much doesn't make a person 'cool'! It's what children do to attract attention!

On Thu, Mar 7, 2019 at 7:38 AM Nils Blömeke notifications@github.com wrote:

Talk to Discord about stopping children from using stupid crap in their names! Seeing as the markdown characters are just regular characters, i dont see that happening. Why disallow stars in (nick)names?

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/Dragory/modmailbot/issues/235#issuecomment-470528102, or mute the thread https://github.com/notifications/unsubscribe-auth/Ah5OQ7JxfwqLDKet1QnTRzT8evrTcwfVks5vURZMgaJpZM4biIZe .

DarkView commented 5 years ago

I do, but why does that matter? For now it is allowed so for now it is an issue.

smooreace commented 5 years ago

You asked a question... I simply answered.

You made a good point initially. So instead of hundreds of people having to work around that issue, let's address it properly.... at the core of the problem! That's how things are done efficiently.

On Thu, Mar 7, 2019 at 7:47 AM Nils Blömeke notifications@github.com wrote:

I do, but why does that matter? For now it is allowed so for now it is an issue.

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/Dragory/modmailbot/issues/235#issuecomment-470531292, or mute the thread https://github.com/notifications/unsubscribe-auth/Ah5OQw0dWOu00kZgBqVvsTcoVuAsY_jOks5vURh9gaJpZM4biIZe .

DarkView commented 5 years ago

True, however i still feel like this should get a fix for modmail. It could cause some issues and so far discord isnt against it. If discord decides to block markdown in (nick)names, it can be removed again :)

smooreace commented 5 years ago

That's somewhat fair, but bandaids don't SOLVE anything. They just let people pretend a problem no longer exists. YOU aren't the one coding that bandaid! Imagine how long it will take 500 bot authors to "fix" this, and then unfix it once the true problem is resolved. Compared to how long it takes Discord to globally remove all the BS characters from a database of all usernames.

Hundreds of hours vs a few keystrokes....

On Thu, Mar 7, 2019 at 8:11 AM Nils Blömeke notifications@github.com wrote:

True, however i still feel like this should get a fix for modmail. It could cause some issues and so far discord isnt against it. If discord decides to block markdown in (nick)names, it can be removed again :)

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/Dragory/modmailbot/issues/235#issuecomment-470540094, or mute the thread https://github.com/notifications/unsubscribe-auth/Ah5OQyMOKx2UkOfL-t3nrw5RHLJnxzenks5vUR4vgaJpZM4biIZe .

DarkView commented 5 years ago

I didnt say i wouldnt bring it to attention. But sometimes bandaids are needed

Dragory commented 5 years ago

Markdown in usernames/nicknames should now be escaped. Please open a new issue if you still see this problem somewhere.