From 0601db18d2add1820025ad0395be76fbbc1e52be Mon Sep 17 00:00:00 2001 From: Bobbahbrown Date: Sun, 23 Feb 2020 15:56:30 -0400 Subject: [PATCH] Unsanitized input for advanced injector name allows raw HTML injection (#49531) About The Pull Request Unsanitized input allows for raw HTML injection on specifying advanced injector name inside a DNA console. --- code/game/machinery/computer/dna_console.dm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/code/game/machinery/computer/dna_console.dm b/code/game/machinery/computer/dna_console.dm index 5fea233e655..0a15070c4cc 100644 --- a/code/game/machinery/computer/dna_console.dm +++ b/code/game/machinery/computer/dna_console.dm @@ -923,7 +923,7 @@ if("add_advinjector") if(LAZYLEN(injector_selection) < max_injector_selections) - var/new_selection = input(usr, "Enter Adv. Injector name", "Advanced Injectors") as text|null + var/new_selection = stripped_input(usr, "Enter Adv. Injector name", "Advanced Injectors") if(new_selection && !(new_selection in injector_selection)) injector_selection[new_selection] = list()