properly implementing xss protection

still serverside which isn't the best but it'll do for now

Author: NexusNull

src/client/scripts/Chat.js

@@ -59,11 +59,9 @@ Chat = class Chat {
   }
 
   log(message) {
-    const replacements = [[/&/g, "&amp;"], [/</g, "&lt;"], [/>/g, "&gt;"], [/"/g, "&quot;"]];
-    for (const replacement of replacements)
-      message = message.replace(replacement[0], replacement[1]);
-
-    this.chatDiv.append(`<span>${message}<br></span>`);
+    let elem = document.createElement("div");
+    elem.innerHTML = message+"<br>";
+    this.chatDiv.append(elem);
     this.scrollToBottom(this.chatDiv);
   }
 

src/index.js

@@ -95,6 +95,13 @@ io.sockets.on("connection", function (socket) {
       emit(["kicked", reason]);
     },
     message: function (msg) {
+      let message = msg.extra[0].text
+
+      const replacements = [[/&/g, "&amp;"], [/</g, "&lt;"], [/>/g, "&gt;"], [/"/g, "&quot;"]];
+      for (const replacement of replacements)
+        message = message.replace(replacement[0], replacement[1]);
+      msg.extra[0].text = message;
+
       emit(["msg", convert.toHtml(msg.toAnsi())]);
     },
     experience: function () {