search

discordjs / Commando

Official command framework for discord.js
Apache License 2.0
497 stars 243 forks source link

Unknown command allows pinging everyone #373

Closed danbulant closed 3 years ago

danbulant commented 3 years ago

Just randomly found that you can use unknown command directly and that it just writes it's arguments.

It normally formats it into inline code blocks, but if you add a backtick and then @everyone the bot will gladly ping everyone (if it has permission to do so). Example can be used by running "unknown-command s` @everyone".

dragonfire535 commented 3 years ago

I'm not sure what you mean, the unknown-command command does not have any arguments (and if an unknown command is used, nothing from the message is written).

danbulant commented 3 years ago

Just looked into it. Commando doesn't have arguments by default (that's something I added since I noticed that commando does send the command name as it's argument, it's just not used in the default unknown command). It instead prints the whole message.

Screenshot from the commando test bot: image

dragonfire535 commented 3 years ago

Yeah, this is a you problem then.

danbulant commented 3 years ago

@dragonfire535 I think you misunderstood.

I'm not sure what you mean, the unknown-command command does not have any arguments (and if an unknown command is used, nothing from the message is written).

this is true, it instead prints the whole message. image

this image shows the problem from the default command unknown command (this is from unedited test bot of commando). The issue is still present in commando.

dukeofsussex commented 3 years ago

I just ran the test bot and it doesn't provide that response. unknown-command also doesn't reply with the original message content.

dragonfire535 commented 3 years ago

https://github.com/discordjs/Commando/blob/master/src/commands/util/unknown-command.js

There is literally no way for this to happen with the default command.