search

KoltesDigital / atom-foxdot

FoxDot interface for Atom
10 stars 3 forks source link

Sanitize HTML characters when logging subprocess output #13

Closed MrMebelMan closed 3 years ago

MrMebelMan commented 3 years ago

Hi, I've found this bug by trying to print the active players using 

print(Clock)

Players are represented in this format: <h1 - play>, <jb - jbass>, and atom thinks it's an HTML markup, so the output was messed up:

Selection_999(076)

You can also do other silly things with it ofc

Selection_999(079)

This PR fixes the printing of Player objects, but you can still embed code... I gues this is Atom's issue?

Selection_999(081)

MrMebelMan commented 3 years ago

Oh, I figured it out, I forgot to sanitize stdin. Embeds are now fixed as well.

KoltesDigital commented 3 years ago

Hi!

Thanks for your interest and for finding that! I'm surprised, that's security 101... grrr my bad.

While your solution works, I prefer to avoid adding a new function, which may itself lead to other security issues... when the browser can already handle it: elements have a textContent property which sanitizes inputs. I should have used it from the start, I somehow forgot to follow the source of log messages. I therefore used it instead as of 451dee9850ed079013fcf18188f4f21226254876.

Too bad because I think live Rick Rolling could be an emerging discipline!

MrMebelMan commented 3 years ago

Nice! TIL about textContent 😆