chat xdd protection

Author: michaljaz

src/client/scripts/Chat.js

@@ -53,10 +53,9 @@ class Chat {
     }
 
     log(message) {
-        const replacements = [[/&/g, "&amp;"], [/</g, "&lt;"], [/>/g, "&gt;"], [/"/g, "&quot;"]];
-        for (const replacement of replacements)
-            message = message.replace(replacement[0], replacement[1]);
-        $(".chat").append(`<span>${message}<br></span>`);
+        let elem = document.createElement("div");
+        elem.innerHTML = message + "<br>";
+        this.chatDiv.append(elem);
         this.scrollToBottom(this.chatDiv);
     }
 

src/index.js

@@ -75,6 +75,18 @@ io.sockets.on("connection", function (socket) {
         socket.emit("kicked", reason);
     });
     bot.on("message", function (msg) {
+        let message = msg.extra[0].text;
+
+        const replacements = [
+            [/&/g, "&"],
+            [/</g, "&lt;"],
+            [/>/g, "&gt;"],
+            [/"/g, "&quot;"],
+        ];
+        for (const replacement of replacements)
+            message = message.replace(replacement[0], replacement[1]);
+        msg.extra[0].text = message;
+
         socket.emit("msg", convert.toHtml(msg.toAnsi()));
     });
     bot.on("experience", function () {