Sanitize bot output

[lemonsaurus]

The problem

Right now, it is possible to exploit certain parts of the bot in order to make the bot post things a regular member would normally not be allowed to post.

These techniques can be used to circumvent our filters, which is somewhat problematic.

For example, by using eval to build a string containing a discord guild invite, you can circumvent our guild invite filter.

You can also do this by exploiting the fact that our custom exception format will repeat the input

Running filters over eval output

To fix the exploit involving !eval, we should change the !eval command so that it will not return anything that triggers a filter.

Let's change the Snekbox cog so that we will do the following:

• Call snekbox and get the output
• Run the output through all the active filters.
• If a filter is triggered, do not post the output. Instead post a message that says something like Attempt to circumvent filter detected. Moderator team has been alerted.

To do this, we will probably also need to make some changes to the Filtering cog so that we can run filters over an arbitrary string.

Changing the custom exception output

Currently when we return our custom exceptions, we repeat the input that failed. The simplest solution is not to do this.

Let's simply change this code so that the exception output does not repeat the input, but otherwise looks more or less the same.

[slushiegoose]

I can do this

[lemonsaurus]

Okay @slushiegoose, who are you on Discord?

[slushiegoose]

slushiegoose#7362

[lemonsaurus]

okay, I've assigned you. Let us know in #dev-contrib if you need any assistance.

[Numerlor]

I was thinking we could create an utility function, or a global filter on all messages for this. There are a couple more cogs - like Doc, which output the user's input on fails.
Perhaps something could also be added to contributing so it's checked for every new feature

[sco1]

which output the user's input on fails

This is going to be removed

[lemonsaurus]

I mean, the proposal here is to change the global custom exception handler, that should apply to all cogs, as long as they are using this method of delivering exceptions. Which they should be.

[Numerlor]

which output the user's input on fails

This is going to be removed

The doc cog outputs its own embeds instead of raising BadArguments when the requested symbol is not found

[lemonsaurus]

Then it would probably be better to make the Doc cog raise BadArguments.

The problem with running all bot messages through filters is that this would need a bunch of exceptions, like our infraction search command, mod-log and mod-alerts embeds, and so on. I think it's better if we just try to generalize exceptions around the BadArguments approach.

[slushiegoose]

Due to BadArgument's formatting and the fact that discord.py's own converters' error messages actually contain the argument swithin it, I personally think the easiest way is to run the BadArgument error message through the filtering. Would love to hear other people's opinions on this.