search

Sokomine / travelnet

network of teleporter-boxes that allow easy travelling to other boxes on the same network (Mod for Minetest)
GNU General Public License v3.0
30 stars 52 forks source link

Escape formspec reserved characters #19

Closed beyondlimits closed 6 years ago

beyondlimits commented 7 years ago

Since station parameters aren't properly escaped when passed to formspec, some characters like ;, ] cause trouble displaying. It is even possible to manipulate formspec appearance by cleverly constructing station/network name, like preview of someone else's chest contents:

]list[nodemeta:13983,10,5575;main;0,0;8,4;

HybridDog commented 7 years ago

You can even crash fairly everyone who rightclicks your travelnet box: ]image[0,0;10,10;default_sand.png^[resize:102400x102400

beyondlimits commented 7 years ago

No feedback from developer so I think it's not important. Closing.

SnarkBoojum commented 7 years ago

Why is that report closed if the problem isn't fixed?

beyondlimits commented 7 years ago

If 8 changed lines of code cannot get merged in reasonable time then why bother contributing?

HybridDog commented 6 years ago

@Sokomine recently merged PRs, maybe this can be merged now?

Sokomine commented 6 years ago

qbeyondlimits: Some PRs might get overlooked while other things are worked at. If something important as this one shows up, please also alert me on IRC. And: Thanks for the PR. It is certainly reasonable to use formspec_escape there.