The fix for #310 stops escaping HTML in the webclient
See original GitHub issueBrief summary of the issue:
The fix for #310 stopped Evennia from modifying the content of the output of the @py
command. This causes HTML to be passed through without escaping
Steps to reproduce the issue:
Run @py '<script>alert("xss!!1")</script><h1>This is an H1</h1>'
Expected output:
>>> '<script>alert("xss!!1")</script><h1>This is an H1</h1>'
<script>alert("xss!!1")</script><h1>This is an H1</h1>
Actual output:
>>> 'This is an H1
'
This is an H1
as well as two alert()
boxes saying “xss!!1”
More info:
This also causes a problem when printing out objects, because the default return value of __str__
looks like this:
<object object at 0x1002cd090>
This renders a literal <object>
element into the webclient.
Want to back this issue? Post a bounty on it! We accept bounties via Bountysource. </bountysource-plugin>
Issue Analytics
- State:
- Created 6 years ago
- Comments:14 (14 by maintainers)
Top Results From Across the Web
Web on Servlet Stack - Spring
The bind macro assumes the default HTML escaping behavior specified by the ServletContext parameter defaultHtmlEscape in web.xml . An alternative form of the ......
Read more >[Java][WebClient] better code format by wing328 · Pull Request ...
Run the shell script(s) under ./bin/ (or Windows batch scripts under .\bin\windows ) to update Petstore samples related to your fix. This is...
Read more >Changes - HtmlUnit - SourceForge
A bug in one faq sample code that might result in wrong encoding is fixed. rbri ... Fix, Links to issues and pulls...
Read more >Web service error codes (Microsoft Dataverse) - Power Apps
This topic lists the error codes you might encounter when you debug your code.
Read more >src/twisted/web/topfiles/NEWS ... - Kitware GitLab
a socket for long enough, Twisted will stop reading further. 21. requests from that client until it consumes some responses. (#8868).
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
@Griatch @BlauFeuer Let me know - and maybe we can see what others think about it. I know @vlegoff has also expressed interest in an @py/raw flag - the current behavior can be quite annoying when attempting to, for instance, look at a list of objects.
I can put a PR through today to fix, if you wish, I think. I have a branch that should fix it.