From fd75f3116aa30eb4958cc747f944f202ec69a484 Mon Sep 17 00:00:00 2001 From: Osmium Sorcerer Date: Wed, 3 Jun 2026 11:23:33 +0000 Subject: Remove safeTags, decodeChat, and prepChat Following the removal of innerHTML manipulation, we no longer need these sanitization functions. I've reviewed every safeTags call site to make sure the outputs don't end up anywhere unsafe, and malicious input can't malipulate DOM or execute code. These values either end up either as plain text (textContent, innerText, createTextNode, title, option) or as a URL path to request assets to the server (encoded using encodeURI). That is, if safeTags was even effective, considering all that function did was replace '<' and '>' symbols with Unicode lookalikes. Even the comment was suggesting the use of fundamentally safer functions instead of these hacks. Replace remaining uses of prepChat with unescapeChat as we still need to do the token substitution (like "" to "&"). decodeChat was escaping Unicode sequences like \uXXXX, but I don't see the reason for this, AO2 Client doesn't have this feature, and considering WebSocket text frames are strictly UTF-8, we don't need these encodings. --- webAO/master.ts | 2 -- 1 file changed, 2 deletions(-) (limited to 'webAO/master.ts') diff --git a/webAO/master.ts b/webAO/master.ts index 569795e..fd7b9a6 100644 --- a/webAO/master.ts +++ b/webAO/master.ts @@ -1,5 +1,3 @@ -import { safeTags } from "./encoding"; - interface AOServer { name: string; description: string; -- cgit