Block html injections in c_hsay

Author: Frozen-H2O

src/adminsystem.cpp

@@ -561,7 +561,9 @@ CON_COMMAND_CHAT_FLAGS(hsay, "<message> - Say something as a hud hint", ADMFLAG_
 		return;
 	}
 
-	SendHudMessageAll(10, 99, "<span class='fontSize-l'><span color='#FFFFFF'>ADMIN: </span><span color='#D11313'>%s</span></span>", args.ArgS());
+	SendHudMessageAll(
+		10, 99, "<span class='fontSize-l'><span color='#FFFFFF'>ADMIN: </span><span color='#D11313'>%s</span></span>",
+		EscapeHTMLSpecialCharacters(args.ArgS()).c_str());
 }
 
 CON_COMMAND_CHAT_FLAGS(rcon, "<command> - Send a command to server console", ADMFLAG_RCON)

src/utils/hud_manager.cpp

@@ -145,4 +145,24 @@ void StartFlashingFixTimer()
 
 		return 0.5f;
 	});
+}
+
+std::string EscapeHTMLSpecialCharacters(std::string strMsg)
+{
+	// Always replace & first, as it is used in html escaped characters (so dont want to replace inside an escape)
+	for (size_t pos = 0; (pos = strMsg.find('&', pos)) != std::string::npos; pos += 5)
+		strMsg.replace(pos, 1, "&");
+
+	std::unordered_map<std::string, std::string> mapReplacements{
+		{"<", "&lt;"},
+		{">", "&gt;"},
+		{"\"", "&quot;"},
+		{"\'", "&apos;"}
+	};
+
+	for (const auto& [badChar, escapedChar] : mapReplacements)
+		for (size_t pos = 0; (pos = strMsg.find(badChar, pos)) != std::string::npos; pos += escapedChar.length())
+			strMsg.replace(pos, 1, escapedChar);
+
+	return strMsg;
 }

src/utils/hud_manager.h

@@ -53,5 +53,6 @@ void SendHudMessage(ZEPlayer* pPlayer, int iDuration, int iPriority, const char*
 void SendHudMessageAll(int iDuration, int iPriority, const char* pszMessage, ...);
 
 void StartFlashingFixTimer();
+std::string EscapeHTMLSpecialCharacters(std::string strMsg);
 
 extern CConVar<bool> g_cvarFixHudFlashing;