echoWanderer / altV-Chat

Do you want a chat resource for you server, but official one just doesn't make your wishes come true? Ta-da-da-dam, I present you - Custom alt:V Chat Resource!
MIT License
13 stars 8 forks source link

Added simple sanitization of input #3

Open kubeeek opened 4 years ago

kubeeek commented 4 years ago

Any input from user should be escaped or sanitized. Now it's possible to send malicious code across clients (XSS exploit), for an example try to send <script>for(var i = 0; i < 99999; i++) { console.log(i) }</script>, it will crash CEF. I have added simple regex replace, so:

<script></script>

becomes:

scriptscript