search

SReject / mTwitch

Twitch normalizer for mIRC
21 stars 8 forks source link

StateToTopic allows for arbitrary code execution #3

Closed racingpro closed 8 years ago

racingpro commented 8 years ago

Having the | character in the title of a stream (and I'd assume game as well) makes mirc parse the rest of the title as a new line, allowing for someone to possibly execute code. I tested for fun on another network not utilizing your script, and as expected it was not parsed as a new line.

I don't know if there's an easy way to fix this, as I'm way below this level of scripting, but replacing that in the original %title grabber with $chr(166) proved to work quite well for me.

actual title mirc title via StateToTopic attempted "code" execution

SReject commented 8 years ago

This has been fixed as of commit dbbc32cbed235dfb0aa9d369ee2608f613d4044b