Merge pull request #11985 from Tayyyyyyy/admin_pencode

Add admin pencode: style, class, and img

code/__HELPERS/text.dm

@@ -545,6 +545,43 @@ proc/checkhtml(var/t)
 	text = copytext(text, 1, MAX_PAPER_MESSAGE_LEN)
 	return text
 
+/proc/convert_pencode_arg(text, tag, arg)
+	arg = sanitize_simple(html_encode(arg), list("''"="","\""="", "?"=""))
+	// https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#rule-4---css-escape-and-strictly-validate-before-inserting-untrusted-data-into-html-style-property-values
+	var/list/style_attacks = list("javascript:", "expression", "byond:", "file:")
+
+	for(var/style_attack in style_attacks)
+		if(findtext(arg, style_attack))
+			// Do not attempt to render dangerous things
+			return text
+
+	if(tag == "class")
+		return "<span class='[arg]'>"
+
+	if(tag == "style")
+		return "<span style='[arg]'>"
+
+	if(tag == "img")
+		var/list/img_props = splittext(arg, ";")
+		if(img_props.len == 3)
+			return "<img src='[img_props[1]]' width='[img_props[2]]' height='[img_props[3]]'>"
+		if(img_props.len == 2)
+			return "<img src='[img_props[1]]' width='[img_props[2]]'>"
+		return "<img src='[arg]'>"
+
+	return text
+
+/proc/admin_pencode_to_html()
+	var/text = pencode_to_html(arglist(args))
+	var/regex/R = new(@"\[(.*?) (.*?)\]", "ge")
+	text = R.Replace(text, /proc/convert_pencode_arg)
+
+	text = replacetext(text, "\[/class\]", "</span>")
+	text = replacetext(text, "\[/style\]", "</span>")
+	text = replacetext(text, "\[/img\]", "</img>")
+
+	return text
+
 /proc/html_to_pencode(text)
 	text = replacetext(text, "<BR>",								"\n")
 	text = replacetext(text, "<center>",							"\[center\]")

code/modules/admin/admin_verbs.dm

@@ -644,7 +644,7 @@ var/list/admin_verbs_ticket = list(
 		if(!message)
 			return
 		for(var/mob/V in hearers(O))
-			V.show_message(message, 2)
+			V.show_message(admin_pencode_to_html(message), 2)
 		log_admin("[key_name(usr)] made [O] at [O.x], [O.y], [O.z] make a sound")
 		message_admins("<span class='notice'>[key_name_admin(usr)] made [O] at [O.x], [O.y], [O.z] make a sound</span>")
 		feedback_add_details("admin_verb","MS") //If you are copy-pasting this, ensure the 2nd parameter is unique to the new proc!

code/modules/admin/topic.dm

@@ -2186,7 +2186,7 @@
 		if(!input)
 			qdel(P)
 			return
-		input = P.parsepencode(input) // Encode everything from pencode to html
+		input = admin_pencode_to_html(html_encode(input)) // Encode everything from pencode to html
 
 		var/customname = clean_input("Pick a title for the fax.", "Fax Title", , owner)
 		if(!customname)

code/modules/admin/verbs/adminpm.dm

@@ -110,7 +110,7 @@
 		if(!msg)
 			return
 	else
-		msg = pencode_to_html(msg)
+		msg = admin_pencode_to_html(msg)
 
 	var/recieve_span = "playerreply"
 	var/send_pm_type = " "

code/modules/admin/verbs/randomverbs.dm

@@ -58,6 +58,9 @@
 
 	if(!msg)
 		return
+
+	msg = admin_pencode_to_html(msg)
+
 	if(usr)
 		if(usr.client)
 			if(usr.client.holder)
@@ -136,7 +139,7 @@
 
 	if( !msg )
 		return
-	msg = pencode_to_html(msg)
+	msg = admin_pencode_to_html(msg)
 
 	to_chat(M, msg)
 	log_admin("DirectNarrate: [key_name(usr)] to ([key_name(M)]): [msg]")