[S] Yikes exploit fixes attempt 2 (#27248)

* how did we miss this

* paper prevention

* optimise prime

* wow

code/modules/paperwork/paper.dm

@@ -47,6 +47,7 @@
 	var/const/deffont = "Verdana"
 	var/const/signfont = "Times New Roman"
 	var/const/crayonfont = "Comic Sans MS"
+	var/regex/blacklist = new("(<iframe|<embed|<script|<canvas|<video|<audio|onload)", "g") // Blacklist of naughties
 
 //lipstick wiping is in code/game/objects/items/weapons/cosmetics.dm!
 
@@ -314,6 +315,13 @@
 		\[time\] : Inserts the current station time in HH:MM:SS.<br>
 	</BODY></HTML>"}, "window=paper_help")
 
+/obj/item/paper/vv_edit_var(var_name, var_value)
+	if((var_name == "info") && blacklist.Find(var_value)) //uh oh, they tried to be naughty
+		message_admins("<span class='danger'>EXPLOIT WARNING: ADMIN</span> [usr.ckey] attempted to write paper containing JS abusable tags!")
+		log_admin("EXPLOIT WARNING: ADMIN [usr.ckey] attempted to write paper containing JS abusable tags")
+		return FALSE
+	return ..()
+
 /obj/item/paper/proc/topic_href_write(id, input_element)
 	var/obj/item/item_write = usr.get_active_hand() // Check to see if he still got that darn pen, also check if he's using a crayon or pen.
 	add_hiddenprint(usr) // No more forging nasty documents as someone else, you jerks
@@ -321,6 +329,10 @@
 		return
 	if(loc != usr && !Adjacent(usr) && !((istype(loc, /obj/item/clipboard) || istype(loc, /obj/item/folder)) && ((usr in get_turf(src)) || loc.Adjacent(usr))))
 		return // If paper is not in usr, then it must be near them, or in a clipboard or folder, which must be in or near usr
+	if(blacklist.Find(input_element)) //uh oh, they tried to be naughty
+		message_admins("<span class='danger'>EXPLOIT WARNING: </span> [usr.ckey] attempted to write paper containing JS abusable tags!")
+		log_admin("EXPLOIT WARNING: [usr.ckey] attempted to write paper containing JS abusable tags")
+		return FALSE
 	input_element = parsepencode(input_element, item_write, usr) // Encode everything from pencode to html
 	if(id != "end")
 		addtofield(text2num(id), input_element) // He wants to edit a field, let him.

tgui/packages/tgui-panel/chat/renderer.js

@@ -4,6 +4,7 @@
  * @license MIT
  */
 
+import DOMPurify from 'dompurify';
 import { EventEmitter } from 'common/events';
 import { classes } from 'common/react';
 import { createLogger } from 'tgui/logging';
@@ -29,6 +30,9 @@ const logger = createLogger('chatRenderer');
 // that is still trackable.
 const SCROLL_TRACKING_TOLERANCE = 24;
 
+// List of blacklisted tags
+const blacklisted_tags = ['iframe', 'video'];
+
 const findNearestScrollableParent = (startingNode) => {
   const body = document.body;
   let node = startingNode;
@@ -359,6 +363,11 @@ class ChatRenderer {
         // Payload is HTML
         else if (message.html) {
           node.innerHTML = message.html;
+          node.innerHTML = DOMPurify.sanitize(node.innerHTML, {
+            // No iframes in my chat kkthxbye
+            FORBID_TAGS: blacklisted_tags,
+            ALLOW_UNKNOWN_PROTOCOLS: true,
+          });
         } else {
           logger.error('Error: message is missing text payload', message);
         }