openmhz / trunk-server

Listen to Trunk Record and explore archived calls. This is the software behind OpenMHz
https://openmhz.com
115 stars 33 forks source link

admin.openmhz.com is overly aggressive with its character stripping in titles and descriptions #157

Open theficus opened 10 months ago

theficus commented 10 months ago

It's very hard to write a coherent description for a feed as it strips things like parenthesis, line feeds, and others.

For instance, if I type a feed title like this:

Puget Sound Emergency Radio Network (PSERN) Full

it becomes:

Puget Sound Emergency Radio Network PSERN Full

If I try to add line feeds to a feed description to separate out areas, they get removed putting all the text into one continuous blob. (Interestingly, line feeds are preserved if I edit the description, but parenthesis are stripped out completely.)

It looks like all of these characters get stripped when saving: ~!@#$%^&*()+=``~"'<>?/\|.

Surely there's a way to be less heavy-handed here by not stripping these characters out. (I'm assuming this is some sort of injection or XSS defense-in-depth, but there's plenty of mitigations for this that don't involve discarding user input.)