Security issue: Possible exploit from use of line break in channel message

Brief summary of issue / Description of requested feature:

A user privately forwarded this possible exploit example. It is due to the channel message accepting line breaks in the web client.

Steps to reproduce the issue / Reasons for adding feature:

In the web client:

1. public Hello!\n[Public] Griatch: Evennia is being re-written using Java.
2. The output will be

   [Public] pruman: Hello!
   [Public] Griatch: Evennia is being re-written using Java.
   

… which can be confusing,

Error output / Expected result of feature

We’d need to discuss how to handle this one. Using line breaks is a useful feature for a more advanced formatting of messages, but this kind of look-alike messaging could indeed be exploited, especially since colors are also possible to use in a channel message.

Extra information, such as Evennia revision/repo/branch, operating system and ideas for how to solve / implement:

The HTML converter will map line break to <br>, which causes this effect:

 return text.replace(r'\n', r'<br>')

This ties to other issues with how we handle the web client parsing - such as when we should pass through raw html or not.

<bountysource-plugin>

---

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource. </bountysource-plugin>

[Griatch]

In develop branch I have now implemented a variation that resolves this for the given example. I didn’t want to limit input in the general sense for all commands but instead I introduced a utility function that does the stripping of input while also offering a setting for ignoring inputs from privileged users. This way, that helper can be applied on commands where an exploit is needed, but not get rid of e.g. |/ inputs globally (this can be useful and safe for certain commands after all)

So this solution is a sort of mix between @trhr’s solution and a per-command sanitization helper.

You can test it by trying the example in the original issue (using |/ instead of \n) as Builder or -not.

[trhr]

This is related to issue where MXP is able to distribute arbitrarily executable code in clickable links.