Handle entity escaping later in received messages.

ekmartin / slack-irc

Connects Slack and IRC channels by sending messages back and forth.

MIT License

588 stars 157 forks source link

Closed jlaunonen closed 7 years ago

jlaunonen commented 7 years ago

Move entity decoding to be last replace operation to avoid limited value injection and denial of service.
Re-arrange entity decoding to avoid them chain-decoding: amp must be decoded last as ampersand is included in lt and gt matches.
Add test-cases for escaped messages.

ekmartin commented 7 years ago

Thanks!

ekmartin commented 7 years ago

Published in version 3.8.5 :smile: