You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository has been archived by the owner on Mar 9, 2021. It is now read-only.
On line 1072, data is declared as: const data = `Recording in ${SendAudioUtil.getChannelName(type)} (${SendAudioUtil.getGuildName(type)})`;
And the getChannelName / getGuildName does not sanitize the name. data is used to create the SendAudioUtil panel and is not sanitized either.
If you want to test this, you can rename a guild or channel to <img src=x onerror=alert(1)> and click the record button.
Result:
The text was updated successfully, but these errors were encountered:
Issue
On line 1072,
data
is declared as:const data = `Recording in ${SendAudioUtil.getChannelName(type)} (${SendAudioUtil.getGuildName(type)})`;
And the
getChannelName
/getGuildName
does not sanitize the name.data
is used to create theSendAudioUtil
panel and is not sanitized either.If you want to test this, you can rename a guild or channel to
<img src=x onerror=alert(1)>
and click the record button.Result:
The text was updated successfully, but these errors were encountered: