The fix for #310 stops escaping HTML in the webclient

Brief summary of the issue:

The fix for #310 stopped Evennia from modifying the content of the output of the @py command. This causes HTML to be passed through without escaping

Steps to reproduce the issue:

Run @py '<script>alert("xss!!1")</script><h1>This is an H1</h1>'

Expected output:

>>> '<script>alert("xss!!1")</script><h1>This is an H1</h1>'
<script>alert("xss!!1")</script><h1>This is an H1</h1>

Actual output:

>>> '
This is an H1
'
This is an H1

as well as two alert() boxes saying “xss!!1”

More info:

This also causes a problem when printing out objects, because the default return value of __str__ looks like this:

<object object at 0x1002cd090>

This renders a literal <object> element into the webclient.

<bountysource-plugin>

---

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource. </bountysource-plugin>

[chainsol]

@Griatch @BlauFeuer Let me know - and maybe we can see what others think about it. I know @vlegoff has also expressed interest in an @py/raw flag - the current behavior can be quite annoying when attempting to, for instance, look at a list of objects.

[chainsol]

I can put a PR through today to fix, if you wish, I think. I have a branch that should fix it.