Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update Global Chat #6381

Draft
wants to merge 3 commits into
base: master
Choose a base branch
from
Draft

Update Global Chat #6381

wants to merge 3 commits into from

Conversation

RusseII
Copy link
Contributor

@RusseII RusseII commented Jul 31, 2024 •
edited
Loading

Fixes the security issues that resulted in plugin getting disabled in 9f331ca
CleanShot 2024-07-31 at 11 59 31@2x

  1. This is exfiltrating all dms to a channel anyone can subscribe

CleanShot 2024-07-31 at 11 42 58@2x

  1. allows spoofing messages with the mod crowns.

  • Fixed by only allowing ironman icons with the new and getValidAccountIcon and isInvalidUsername function

@runelite-github-app
Copy link

runelite-github-app bot commented Jul 31, 2024 •
edited
Loading

global-chat: 403f4d0d17dd537838f3929a37bb095e1e5e3372...9cdb1c0f31c57a214209a836cfbb2973254d629d

This was referenced Jul 31, 2024
Closed
Open
@LlemonDuck
Copy link
Contributor

Instead of checking for specific control characters, it's better to just sanitize the entire message using `Text#removeTags. RusseII/region-chat@403f4d0...RusseII:9cdb1c0f31c57a214209a836cfbb2973254d629d#diff-51d34e1338ae68af40061f38cd1ddea82fbcf922e3c55828aa0e3264d16fd0c2R366-R368

@LlemonDuck
Copy link
Contributor

Marking as draft for now. Please make the requested changes, then mark the plugin as ready for review.

@LlemonDuck LlemonDuck marked this pull request as draft October 15, 2024 03:31
@LlemonDuck LlemonDuck added the waiting for author waiting for the pr author to make changes or respond to questions label Oct 15, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
plugin change waiting for author waiting for the pr author to make changes or respond to questions
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@RusseII @LlemonDuck