hexparrot/mineos

Escape apostrophes before submitting in the console.

Opened this issue · 2 comments

yiays commented

Using a command like say I'm here will throw an error, and is probably a security flaw, as code injection is possible here.

Do you have an example of any code that can be executed through the Minecraft console we'd want to protect from?

yiays commented

Well, I've found, from messing around with it, that you can type in ';' and get some interesting responses from the server, for example;
screenshot-yiaysmc noip me 8080 2015-08-16 12-04-17
And, strangely, the first time I typed in 'echo "Testing";', the server shut down, but I'm unable to reproduce that error.

But, regardless of whether there is potential security problems or not, this should be fixed, as I have to take all apostrophes out of everything I type, or else I get this error;
screenshot-yiaysmc noip me 8080 2015-08-16 12-08-33
Which is quite an annoyance.