strip escape codes from player-supplied input #3925

New Issue

flux · 2023-03-04T01:15:14Z

flux commented

2023-03-04 01:15:14 +00:00

someone has been abusing this, see your-land/reports#509

we can certainly strip color codes out of any chat message sent by a user, if we so wish. i can't see any reason why we'd want that enabled.

and if color codes are possible, it should also be possible to send translator codes, which has ... weird possibilities, but i don't think anything malicious. but probably those should be stripped too.

someone has been abusing this, see https://gitea.your-land.de/your-land/reports/issues/509 we can certainly strip color codes out of any chat message sent by a user, if we so wish. i can't see any reason why we'd want that enabled. and if color codes are possible, it should also be possible to send translator codes, which has ... weird possibilities, but i don't think anything malicious. but probably those should be stripped too.

flux added the

1. kind/enhancement

3. source/integration

labels 2023-03-04 01:15:14 +00:00

AliasAlreadyTaken commented

2023-03-04 15:52:54 +00:00

That's a UI problem and this is my approach:

DMs, Basic chat, be it in channels or in the open need to be decided by the RECEIVER which colour they are in, because they may have a preference, disability or use case for a certain colour.

Books, posters and signposts, anything that a receiver can opt out of receiving may be the colour the SENDER decides on.

Those colours should be configurable via yl_settings per account.

So, yes, let's strip colour codes out of messages for now until yl_settings.

That's a UI problem and this is my approach: DMs, Basic chat, be it in channels or in the open need to be decided by the RECEIVER which colour they are in, because they may have a preference, disability or use case for a certain colour. Books, posters and signposts, anything that a receiver can opt out of receiving may be the colour the SENDER decides on. Those colours should be configurable via yl_settings per account. So, yes, let's strip colour codes out of messages for now until yl_settings.

flux commented

2023-03-04 17:28:14 +00:00

Books, posters and signposts, anything that a receiver can opt out of receiving may be the colour the SENDER decides on.

i think those have their own way of coloring text, and don't require "actual" escape sequences involving \033?

> Books, posters and signposts, anything that a receiver can opt out of receiving may be the colour the SENDER decides on. i think those have their own way of coloring text, and don't require "actual" escape sequences involving `\033`?

flux commented

2023-03-04 17:56:28 +00:00

@AliasAlreadyTaken actually it seems like stripping color codes from chat is not something that's easy to do in lua, but there's a setting e66e583f5e/builtin/settingtypes.txt (L733-L735) strip_color_codes = true in minetest.conf

EDIT: that setting also strips non-color-code escape sequences, so no need to worry about translation escapes and other possibilities.

@AliasAlreadyTaken actually it seems like stripping color codes from chat is *not* something that's easy to do in lua, *but* there's a setting https://github.com/minetest/minetest/blob/e66e583f5e42441bdf17cd60f47174166f08e6d1/builtin/settingtypes.txt#L733-L735 `strip_color_codes = true` in minetest.conf EDIT: that setting also strips non-color-code escape sequences, so no need to worry about translation escapes and other possibilities.

AliasAlreadyTaken commented

2023-03-04 18:56:29 +00:00

This setting is already on true.

flux commented

2023-03-04 19:34:45 +00:00

i've tested the behavior of the following things w/ colored escape sequences:

signs (signs_lib and display_modpack)
posters
mail
personal log
digilines channels
luacontrollers
shared chest names

so far as i can tell, escape sequences get stripped (or just don't work) with the vast majority of things, the exceptions being mail and the body of posters, and i don't feel like their usage there could be considered abuse.

so, i think that setting is all we need to do for this.

i've tested the behavior of the following things w/ colored escape sequences: * signs (signs_lib and display_modpack) * posters * mail * personal log * digilines channels * luacontrollers * shared chest names so far as i can tell, escape sequences get stripped (or just don't work) with the vast majority of things, the exceptions being mail and the body of posters, and i don't feel like their usage there could be considered abuse. so, i think that setting is all we need to do for this.

flux commented

2023-03-04 19:36:48 +00:00

This setting is already on true.

oh. so it is O_O. why isn't it working then...

> This setting is already on true. oh. so it is O_O. why isn't it working then...

flux commented

2023-03-04 19:48:36 +00:00

email to Bla:

i can't replicate this; it seems that colors are already stripped when a player sends any message via chat. can you provide more details?

email to Bla: ``` i can't replicate this; it seems that colors are already stripped when a player sends any message via chat. can you provide more details? ```

flux added the

4. step/question

label 2023-03-04 19:48:46 +00:00

Bla commented

2023-03-04 20:04:19 +00:00

email to Bla:

i can't replicate this; it seems that colors are already stripped when a player sends any message via chat. can you provide more details?

it was a command block, see #3922 (comment)

> email to Bla: > > ``` > i can't replicate this; it seems that colors are already stripped when a player sends any message via chat. can you provide more details? > ``` it was a command block, see https://gitea.your-land.de/your-land/bugtracker/issues/3922#issuecomment-43833

flux commented

2023-03-04 20:12:56 +00:00

closing this as a dupe of #3922, which somehow never saw.

flux closed this issue

2023-03-04 20:12:56 +00:00

flux added

5. result/duplicate

and removed

4. step/question

3. source/integration

labels 2023-03-04 20:13:24 +00:00

Sign in to join this conversation.