XSS using chat

[jlbribeiro]

One for the backlog :)

Describe the bug
It is possible to run JavaScript on all clients by using the chat option.

To Reproduce
Steps to reproduce the behavior:

1. Send <script>alert('Hello World!')</script> as a chat message.
2. All clients display "Hello World!" as a blocking pop-up. The sending player appears to have sent an empty message (in the chat log).

Expected behavior
The text message should appear (literally) in the chat log, instead of being interpreted by the browser as code.

[cdot]

Cool! I'll be honest, XSS vulnerabilities haven't been top of my priority list; though that really ought to be fixed.

[cdot]

31eed27 should close that.

[jlbribeiro]

@cdot I figured it was not top priority, hence why I was just adding it to the "backlog" (I really just tried it out of curiosity).

Thanks for the fix!