From 3ef712a8d4ff0e33d9f28be1535fbd37d6e9d820 Mon Sep 17 00:00:00 2001
From: SkyratBot <59378654+SkyratBot@users.noreply.github.com>
Date: Thu, 20 Aug 2020 02:13:16 +0200
Subject: [PATCH] [MIRROR] [s] sanitizes nanite extra settings  (#426)

* [s] sanitizes nanite extra settings (#53065)

/datum/nanite_extra_setting/text/get_value()
return html_encode(value)

HTML injection bad. Brainwashing and potentially happiness programs are all subject to this, unless code has changed for how objective text is rendered. I don't think there's any case where nanites even need to be able to accept raw html.

* [s] sanitizes nanite extra settings

Co-authored-by: silicons <2003111+silicons@users.noreply.github.com>
---
 code/modules/research/nanites/extra_settings/text.dm | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/code/modules/research/nanites/extra_settings/text.dm b/code/modules/research/nanites/extra_settings/text.dm
index 56aa3dd07f5..d3cad27bcf5 100644
--- a/code/modules/research/nanites/extra_settings/text.dm
+++ b/code/modules/research/nanites/extra_settings/text.dm
@@ -10,6 +10,9 @@
 /datum/nanite_extra_setting/text/get_copy()
 	return new /datum/nanite_extra_setting/text(value)
 
+/datum/nanite_extra_setting/text/get_value()
+	return html_encode(value)
+
 /datum/nanite_extra_setting/text/get_frontend_list(name)
 	return list(list(
 		"name" = name,