From c243b2637f9f1b34e5ff7e7e7704d51e79ac2ea6 Mon Sep 17 00:00:00 2001 From: SmArtKar <44720187+SmArtKar@users.noreply.github.com> Date: Thu, 31 Oct 2024 14:30:33 +0100 Subject: [PATCH] [s] Fixes HTML injections via pet tricks (#87595) ## About The Pull Request Closes #87592 You could pass additional args into emotes with zero sanitization if you got yourself a way to call TGUI acts ## Changelog :cl: fix: Fixed HTML injections via pet tricks /:cl: --- code/modules/mob/living/basic/pets/pet_designer.dm | 3 +++ .../modular_computers/file_system/programs/virtual_pet.dm | 3 +++ 2 files changed, 6 insertions(+) diff --git a/code/modules/mob/living/basic/pets/pet_designer.dm b/code/modules/mob/living/basic/pets/pet_designer.dm index a0cc7ca4018..988fee66038 100644 --- a/code/modules/mob/living/basic/pets/pet_designer.dm +++ b/code/modules/mob/living/basic/pets/pet_designer.dm @@ -163,6 +163,9 @@ GLOBAL_LIST_INIT(pet_options, list( var/list/trick_moves = params["selected_trick_moves"] if(length(trick_moves)) + for (var/trick_move in trick_moves) + if (!length(GLOB.emote_list[LOWER_TEXT(trick_move)])) + trick_moves -= trick_move pet_trick_moves = trick_moves var/selected_color = params["selected_carrier"] diff --git a/code/modules/modular_computers/file_system/programs/virtual_pet.dm b/code/modules/modular_computers/file_system/programs/virtual_pet.dm index eacdb1323b3..746824f8d8b 100644 --- a/code/modules/modular_computers/file_system/programs/virtual_pet.dm +++ b/code/modules/modular_computers/file_system/programs/virtual_pet.dm @@ -559,6 +559,9 @@ GLOBAL_LIST_EMPTY(virtual_pets_list) return TRUE if(!isnull(trick_name)) pet.ai_controller.set_blackboard_key(BB_TRICK_NAME, trick_name) + for (var/trick_move in trick_sequence) + if (!length(GLOB.emote_list[LOWER_TEXT(trick_move)])) + trick_sequence -= trick_move pet.ai_controller.override_blackboard_key(BB_TRICK_SEQUENCE, trick_sequence) playsound(computer.loc, 'sound/mobs/non-humanoids/orbie/orbie_trick_learned.ogg', 50)