Fixes #10828 (#10830)

* Fixes #10828

* fixes log cache

* fixes changelog fix changelog

html/changelogs/.all_changelog.yml

@@ -17544,7 +17544,7 @@ DO NOT EDIT THIS FILE BY HAND!  AUTOMATICALLY GENERATED BY ss13_genchangelog.py.
   - rscadd: Ashtrays spill their contents when destroyed.
   - rscadd: Using an ashtray in hand will dump its contents onto the ground.
   - rscadd: Hitting an ashtray will now produce a sound and a visible message.
-  - bugfix: Fixes contagious UI styling due to an erroneous unscoped <style> tag.
+  - bugfix: Fixes contagious UI styling due to an erroneous unscoped &ltstyle&gt tag.
   - backend: Adds a check to ensure this never happens again.
   - tweak: Makes all VueUI view components use scoped styles. This shouldn't change
       anything except for fixing the aforementioned bug.

html/changelogs/MDP-changelogfix.yml

@@ -0,0 +1,42 @@
+################################
+# Example Changelog File
+#
+# Note: This file, and files beginning with ".", and files that don't end in ".yml" will not be read. If you change this file, you will look really dumb.
+#
+# Your changelog will be merged with a master changelog. (New stuff added only, and only on the date entry for the day it was merged.)
+# When it is, any changes listed below will disappear.
+#
+# Valid Prefixes:
+#   bugfix
+#   wip (For works in progress)
+#   tweak
+#   soundadd
+#   sounddel
+#   rscadd (general adding of nice things)
+#   rscdel (general deleting of nice things)
+#   imageadd
+#   imagedel
+#   maptweak
+#   spellcheck (typo fixes)
+#   experiment
+#   balance
+#   admin
+#   backend
+#   security
+#   refactor
+#################################
+
+# Your name.
+author: MoondancerPony
+
+# Optional: Remove this file after generating master changelog.  Useful for PR changelogs that won't get used again.
+delete-after: True
+
+# Any changes you've made.  See valid prefix list above.
+# INDENT WITH TWO SPACES.  NOT TABS.  SPACES.
+# SCREW THIS UP AND IT WON'T WORK.
+# Also, all entries are changed into a single [] after a master changelog generation. Just remove the brackets when you add new entries.
+# Please surround your changes in  double quotes ("), as certain characters otherwise screws up compiling. The quotes will not show up in the changelog.
+changes:
+  - bugfix: "Fixes the changelog."
+  - backend: "Prevents uses of < and >, particularly when referencing things like <style> tags, from breaking changelogs in the future."

tools/GenerateChangelog/ss13_genchangelog.py

@@ -33,6 +33,7 @@ import sys
 import re
 import time
 import argparse
+from html import escape
 from datetime import datetime, date
 from time import time
 
@@ -126,7 +127,7 @@ if failed_cache_read and os.path.isfile(args.targetFile):
                 for changeT in ulT.children:
                     if changeT.name != 'li':
                         continue
-                    val = changeT.decode_contents(formatter="html")
+                    val = escape(changeT.decode_contents(formatter="html"))
                     newdat = {changeT['class'][0] + '': val + ''}
                     if newdat not in changes:
                         changes += [newdat]
@@ -164,11 +165,11 @@ for fileName in glob.glob(os.path.join(args.ymlDir, "*.yml")):
         new = 0
         for change in cl['changes']:
             if change not in author_entries:
-                (change_type, _) = dictToTuples(change)[0]
+                (change_type, change_entry) = dictToTuples(change)[0]
                 if change_type not in validPrefixes:
                     errors = True
                     print('  {0}: Invalid prefix {1}'.format(fileName, change_type), file=sys.stderr)
-                author_entries += [change]
+                author_entries += [{change_type : escape(change_entry)}]
                 new += 1
         all_changelog_entries[today][cl['author']] = author_entries
         if new > 0: