Sanitize input (#4798)

* Sanitize custom objective summary

* Untouch

Author: Toby222

Content.Client/RoundEnd/RoundEndSummaryWindow.cs

@@ -26,9 +26,11 @@
 using System.Linq;
 using System.Numerics;
 using Content.Client.Message;
+using Content.Client.UserInterface.RichText; // DeltaV - Limit what tags can be used in custom objective summaries
 using Content.Shared.GameTicking;
 using Robust.Client.UserInterface.Controls;
 using Robust.Client.UserInterface.CustomControls;
+using Robust.Client.UserInterface.RichText; // DeltaV - Limit what tags can be used in custom objective summaries
 using Robust.Shared.Utility;
 using static Robust.Client.UserInterface.Controls.BoxContainer;
 
@@ -104,7 +106,20 @@ private BoxContainer MakeRoundEndSummaryTab(string gamemode, string roundEnd, Ti
             if (!string.IsNullOrEmpty(roundEnd))
             {
                 var roundEndLabel = new RichTextLabel();
-                roundEndLabel.SetMarkup(roundEnd);
+                // Begin DeltaV - Limit what tags can be used in custom objective summaries
+                roundEndLabel.SetMessage(
+                    FormattedMessage.FromMarkupPermissive(roundEnd),
+                    [
+                        typeof(BoldItalicTag),
+                        typeof(BoldTag),
+                        typeof(BulletTag),
+                        typeof(ColorTag),
+                        typeof(HeadingTag),
+                        typeof(ItalicTag),
+                        typeof(MonoTag)
+                    ]
+                );
+                // End DeltaV - Limit what tags can be used in custom objective summaries
                 roundEndSummaryContainer.AddChild(roundEndLabel);
             }