Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update Global Chat #6381

Open
wants to merge 4 commits into
base: master
Choose a base branch
from
Open

Update Global Chat #6381

wants to merge 4 commits into from

Conversation

RusseII
Copy link
Contributor

@RusseII RusseII commented Jul 31, 2024 •
edited
Loading

Fixes the security issues that resulted in plugin getting disabled in 9f331ca
CleanShot 2024-07-31 at 11 59 31@2x

  1. This is exfiltrating all dms to a channel anyone can subscribe

CleanShot 2024-07-31 at 11 42 58@2x

  1. allows spoofing messages with the mod crowns.

  • Fixed by only allowing ironman icons with the new and getValidAccountIcon and isInvalidUsername function

@runelite-github-app
Copy link

runelite-github-app bot commented Jul 31, 2024 •
edited
Loading

global-chat: 403f4d0d17dd537838f3929a37bb095e1e5e3372...f2afe9813b9cd887809a5011e30a4ccda1178d36

This was referenced Jul 31, 2024
Closed
Open
@LlemonDuck
Copy link
Contributor

Instead of checking for specific control characters, it's better to just sanitize the entire message using `Text#removeTags. RusseII/region-chat@403f4d0...RusseII:9cdb1c0f31c57a214209a836cfbb2973254d629d#diff-51d34e1338ae68af40061f38cd1ddea82fbcf922e3c55828aa0e3264d16fd0c2R366-R368

@LlemonDuck
Copy link
Contributor

Marking as draft for now. Please make the requested changes, then mark the plugin as ready for review.

@LlemonDuck LlemonDuck marked this pull request as draft October 15, 2024 03:31
@LlemonDuck LlemonDuck added the waiting for author waiting for the pr author to make changes or respond to questions label Oct 15, 2024
@runelite-github-app runelite-github-app bot removed the waiting for author waiting for the pr author to make changes or respond to questions label Oct 19, 2024
@RusseII RusseII marked this pull request as ready for review October 19, 2024 20:01
@RusseII
Copy link
Contributor Author

RusseII commented Oct 19, 2024

Thanks @LlemonDuck. Added your suggestions

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
plugin change
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@RusseII @LlemonDuck