search

TASVideos / tasvideos

The code for the live TASVideos website
https://tasvideos.org/
GNU General Public License v3.0
62 stars 29 forks source link

Sanitize user-provided text before posting to Discord #1698

Closed RetroEdit closed 7 months ago

RetroEdit commented 12 months ago

This has been shown a few times: edit messages will be parsed as Discord Markdown and this has implications.

I think it might be good to prevent the following in edit messages:

The first two could be done by escaping the following six characters with a \ prefix: ()[]<>; clickable links could be done by escaping the / character.

My rationale here is that we don't necessarily want people pinging or inserting misleading links into edit messages, but maybe opinions differ?

For reference, this is what seems to be the official documentation for Discord Markdown: Discord Markdown Text 101

Edit (2023-10-20): Since then, I've seen some more situations, like a user with a username that formats text with __. It might be good to just sanitize everything.

bigbass1997 commented 12 months ago

Note this is applicable to more than just edit messages. Anywhere the bot relays text provided by a human, has the potential to contain Discord markdown. Some examples: