Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Markdown in GitHub entity titles are not sanitised #149

Open
00-kat opened this issue Feb 8, 2025 · 1 comment · May be fixed by #164
Open

Markdown in GitHub entity titles are not sanitised #149

00-kat opened this issue Feb 8, 2025 · 1 comment · May be fixed by #164
Labels
area: entity-mentions bug Something isn't working

Comments

@00-kat
Copy link
Contributor

00-kat commented Feb 8, 2025

Some screenshots of what this causes:
Figure 1

Figure 2

A search for 00-kat/test in the Ghostty bot testing Discord server reveals quite a few too, some of which are shown below. Not all of them are related to Markdown sanitisation but rather general sanitisation of Discord features embedded with special syntax in text messages.
Figure 3
Figure 4
This one required <@user id>, very unlikely apart from intentional abuse, so should likely not be handled. Included for completeness.
Figure 5
Embeds could be very large, this one was luckily small.
Figure 6
Also contrived.
Figure 7
Not as contrived since GitHub also has :emojiname: syntax, and someone who doesn't know GitHub doesn't parse titles may try using them. Though one could argue this is preferable.
Figure 8
Also contrived, but people have a reason to abuse this as it may aid in causing harm.
Figure 9

@trag1c trag1c added bug Something isn't working area: entity-mentions labels Feb 8, 2025
@00-kat
Copy link
Contributor Author

00-kat commented Feb 16, 2025

This is actually easier than I had thought; I had collected a list of characters to escape, but then found discord.utils.escape_markdown and discord.utils.escape_mentions.

@trag1c trag1c linked a pull request Feb 19, 2025 that will close this issue
@00-kat 00-kat linked a pull request Feb 24, 2025 that will close this issue
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area: entity-mentions bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants