prevent xss

NexusNull · NexusNull · commit de070fd556be · 2021-02-28T13:49:06.000+01:00
diff --git a/src/client/scripts/Chat.js b/src/client/scripts/Chat.js
@@ -59,7 +59,11 @@ Chat = class Chat {
   }
 
   log(message) {
-    $(".chat").append(`<span>${message}<br></span>`);
+    const replacements = [[/&/g, "&amp;"], [/</g, "&lt;"], [/>/g, "&gt;"], [/"/g, "&quot;"]];
+    for (const replacement of replacements)
+      message = message.replace(replacement[0], replacement[1]);
+
+    this.chatDiv.append(`<span>${message}<br></span>`);
     this.scrollToBottom(this.chatDiv);
   }
 

Original file line number	Diff line number	Diff line change
`@@ -59,7 +59,11 @@ Chat = class Chat {`
`59`	`59`	`}`
`60`	`60`
`61`	`61`	`log(message) {`
`62`		- $(".chat").append(`<span>${message}<br></span>`);
	`62`	`+ const replacements = [[/&/g, "&"], [/</g, "<"], [/>/g, ">"], [/"/g, """]];`
	`63`	`+ for (const replacement of replacements)`
	`64`	`+ message = message.replace(replacement[0], replacement[1]);`
	`65`	`+`
	`66`	+ this.chatDiv.append(`<span>${message}<br></span>`);
`63`	`67`	`this.scrollToBottom(this.chatDiv);`
`64`	`68`	`}`
`65`	`69`