fixed name injection

gnehs · Jun 16, 2024 · f1ba814 · f1ba814
1 parent e617ed6
commit f1ba814
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/components/stepstep.js b/components/stepstep.js
@@ -30,7 +30,12 @@ bot.command("stepstep", async ({ reply, message }) => {
   rank.forEach((item, index) => {
     let distance = item.distance.toFixed(2);
     let steps = item.steps.toLocaleString();
-    responseText += `<code>${index + 1}. </code>${item.user.name}\n`;
+    let name = item.user.name
+      .replaceAll("<", "&lt;")
+      .replaceAll(">", "&gt;")
+      .replaceAll("&", "&amp;");
+
+    responseText += `<code>${index + 1}. </code>${name}\n`;
     responseText += `<code>   ${distance} 公里 - ${steps} 步</code>\n`;
   });