LightZirconite/Microsoft-Rewards-Bot
1
1
Fork 0
mirror of https://github.com/LightZirconite/Microsoft-Rewards-Bot.git synced 2026-01-11 17:56:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

security: Add Discord mention sanitization to prevent abuse

Browse Source
This commit is contained in:
LightZirconite
2026-01-02 16:18:16 +01:00
parent c56cd0b6b0
commit 56d8e431bd
3 changed files with 79 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/util/notifications/ErrorReportingWebhook.ts
View File

@@ -28,7 +28,12 @@ const SANITIZE_PATTERNS: Array<[RegExp, string]> = [
[/[A-Za-z]:\\(?:[^\\/:*?"<>|\r\n]+\\)*[^\\/:*?"<>|\r\n]*/g, '[PATH_REDACTED]'],
[/\/(?:home|Users)\/[^/\s]+(?:\/[^/\s]+)*/g, '[PATH_REDACTED]'],
[/\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b/g, '[IP_REDACTED]'],
[/\b[A-Za-z0-9_-]{20,}\b/g, '[TOKEN_REDACTED]']
[/\b[A-Za-z0-9_-]{20,}\b/g, '[TOKEN_REDACTED]'],
// Discord mention sanitization (prevent @everyone, @here abuse)
[/@(everyone|here)/gi, '@\u200b$1'], // Zero-width space breaks mentions
[/<@!?(\d+)>/g, '@user'], // User mentions
[/<@&(\d+)>/g, '@role'], // Role mentions
[/<#(\d+)>/g, '#channel'] // Channel mentions
]
function sanitizeSensitiveText(text: string): string {