Sanitize chat inputs - Githubissues

Spacetime-Meta / spacetime-sdk

The spacetime-sdk is a turnkey virtual environment package for building in the Spacetime Metaverse

MIT License

11 stars 2 forks source link

Closed Liquid-Blocks closed 2 years ago

Liquid-Blocks commented 2 years ago

When a new message is sent to the chat box, there is no filtering of the message to remove HTML tags or any other potentially harmful content.

The priority is to remove the <script> tag since injection is a security issue.

If possible (with no compromises on security), allow only the HTML tags related to text formatting ex: ,  , 

codeeMadness commented 2 years ago

Hi @Liquid-Blocks ,

for this issue, I will make use of peerjs-group (has implemented in #148 ). This library provides a function to support this.
about other tags such as ,  ,  I think we should plan to allow box chat support RichTextHTML in future. This will help to prevent security injections.