[FIX] Escape unrecognized slash command message (#14432)

RocketChat · May 8, 2019 · a81123d · a81123d
1 parent e9d6611
commit a81123d
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/app/ui/client/lib/chatMessages.js b/app/ui/client/lib/chatMessages.js
@@ -1,6 +1,7 @@
-import _ from 'underscore';
 import moment from 'moment';
 import toastr from 'toastr';
+import _ from 'underscore';
+import s from 'underscore.string';
 
 import { Meteor } from 'meteor/meteor';
 import { Random } from 'meteor/random';
@@ -429,7 +430,7 @@ export class ChatMessages {
 						_id: Random.id(),
 						rid: msgObject.rid,
 						ts: new Date,
-						msg: TAPi18n.__('No_such_command', { command: match[1] }),
+						msg: TAPi18n.__('No_such_command', { command: s.escapeHTML(match[1]) }),
 						u: {
 							username: settings.get('InternalHubot_Username'),
 						},