[Sugarcube 2] Preventing Code Injection via a Text Input

CordeliaTheTall

Hey there,

I'm working on a game in the Sugarcube 2 format at the moment, and I've run into something that might be an issue. At one point, I allow the player to name a few different things, but I've come to realize that if the player names these items something such as "<<set $Gold to 999999>>" then that code will be run every time I would have otherwise just called what was supposed to be a name.

I figured I might be able to stop this with <<print>> but I haven't had any luck with that, and admittedly I don't really know much about Javascript to be able to manipulate the strings to limit them to alphanumeric symbols, or at least stop this code from being run. Anyone have any ideas on how I could prevent this? Thank you!

TheMadExile

You could check the result, forcing the player to enter a new name if the submitted one contains non-alphanumeric characters—or whatever set you feel the need to restrict. Alternatively, you could simply sanitize the result.

Of the two, the former is likely the better approach here.

How do you have your inputs setup?

CordeliaTheTall

The input is simply <<textbox "$PendingItem" "">> which is then saved with a button press. I'd much prefer implementing the first option of the two you suggested. I'm guessing I can do something involving .contains and either(">", "<", ".", ",")? Again, anything beyond the more basic functions is a bit beyond my understanding, so let me know if I'm on the wrong track. Thank you for the help!

TheMadExile

CordeliaTheTall wrote: »

The input is simply <<textbox "$PendingItem" "">> which is then saved with a button press.

Save with a button press how? What does it look like?

I assume it's something simple, however, I'd rather not give an example and have you come back saying it doesn't work with what you already have.

CordeliaTheTall wrote: »

I'm guessing I can do something involving .contains and either(">", "<", ".", ",")?

The either() function has no place here. While you could use a combination of <Array>.some() and <String>.includes(), the best thing would probably be to use a regular expression.