From 47192ec2f5e8c317cdbb3bf73c248201b035ec7b Mon Sep 17 00:00:00 2001
From: SkyratBot <59378654+SkyratBot@users.noreply.github.com>
Date: Mon, 17 Aug 2020 14:49:08 +0200
Subject: [PATCH] [MIRROR] [s] Fix XSS in Skull Echo (#365)

* Fix XSS in skull echo (#52993)

About The Pull Request

Closes #52992
Changelog

cl
fix: Skull Echo now correctly encodes its speech.
/cl

* [s] Fix XSS in Skull Echo

Co-authored-by: Jared-Fogle <35135081+Jared-Fogle@users.noreply.github.com>
---
 code/modules/research/nanites/nanite_programs/suppression.dm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/code/modules/research/nanites/nanite_programs/suppression.dm b/code/modules/research/nanites/nanite_programs/suppression.dm
index 8b8ea83bbf9..8100e50aa78 100644
--- a/code/modules/research/nanites/nanite_programs/suppression.dm
+++ b/code/modules/research/nanites/nanite_programs/suppression.dm
@@ -174,7 +174,7 @@
 		sent_message = message_setting.get_value()
 	if(host_mob.stat == DEAD)
 		return
-	to_chat(host_mob, "<i>You hear a strange, robotic voice in your head...</i> \"<span class='robot'>[sent_message]</span>\"")
+	to_chat(host_mob, "<i>You hear a strange, robotic voice in your head...</i> \"<span class='robot'>[html_encode(sent_message)]</span>\"")
 
 /datum/nanite_program/comm/hallucination
 	name = "Hallucination"