fix: purify nation-authored HTML at server boundaries

app/game-api/src/router/join/index.ts

@@ -20,6 +20,7 @@ import {
     RejectedNpcPossessionCommandError,
 } from '../../daemon/databaseTransport.js';
 import { NpcPossessionError, reserveNpcPossessionCandidates } from '@sammo-ts/game-engine';
+import { resolveNationScoutMessage } from '../nation/shared.js';
 
 const resolveSelectionCommandResult = (
     result: Awaited<ReturnType<GameApiContext['turnDaemon']['requestCommand']>> | null,
@@ -302,7 +303,7 @@ export const joinRouter = router({
                 id: nation.id,
                 name: nation.name,
                 color: nation.color,
-                scoutMessage: typeof meta.infoText === 'string' ? meta.infoText : null,
+                scoutMessage: resolveNationScoutMessage(meta) || null,
             };
         });
 

app/game-api/src/router/nation/endpoints/setNotice.ts

@@ -3,6 +3,7 @@ import { z } from 'zod';
 
 import { asRecord } from '@sammo-ts/common';
 
+import { purifyNationHtml } from '../../../security/nationHtml.js';
 import { authedProcedure } from '../../../trpc.js';
 import { getMyGeneral } from '../../shared/general.js';
 import { assertNationAccess, assertNationEditable, updateNationMeta } from '../shared.js';
@@ -10,7 +11,7 @@ import { assertNationAccess, assertNationEditable, updateNationMeta } from '../s
 export const setNotice = authedProcedure
     .input(
         z.object({
-            msg: z.string().max(16384),
+            msg: z.string().min(1).max(16384),
         })
     )
     .mutation(async ({ ctx, input }) => {
@@ -25,13 +26,14 @@ export const setNotice = authedProcedure
         }
         assertNationEditable(me, nation.meta);
         const nationMeta = asRecord(nation.meta);
+        const msg = purifyNationHtml(input.msg);
         await updateNationMeta(
             ctx,
             me.nationId,
             {
-                notice: input.msg,
+                notice: msg,
             },
             nationMeta
         );
-        return { ok: true };
+        return { ok: true, msg };
     });

app/game-api/src/router/nation/endpoints/setScoutMsg.ts

@@ -3,6 +3,7 @@ import { z } from 'zod';
 
 import { asRecord } from '@sammo-ts/common';
 
+import { purifyNationHtml } from '../../../security/nationHtml.js';
 import { authedProcedure } from '../../../trpc.js';
 import { getMyGeneral } from '../../shared/general.js';
 import { assertNationAccess, assertNationEditable, updateNationMeta } from '../shared.js';
@@ -10,7 +11,7 @@ import { assertNationAccess, assertNationEditable, updateNationMeta } from '../s
 export const setScoutMsg = authedProcedure
     .input(
         z.object({
-            msg: z.string().max(1000),
+            msg: z.string().min(1).max(1000),
         })
     )
     .mutation(async ({ ctx, input }) => {
@@ -25,13 +26,14 @@ export const setScoutMsg = authedProcedure
         }
         assertNationEditable(me, nation.meta);
         const nationMeta = asRecord(nation.meta);
+        const msg = purifyNationHtml(input.msg);
         await updateNationMeta(
             ctx,
             me.nationId,
             {
-                infoText: input.msg,
+                infoText: msg,
             },
             nationMeta
         );
-        return { ok: true };
+        return { ok: true, msg };
     });

app/game-api/src/router/nation/shared.ts

@@ -27,6 +27,7 @@ import {
 } from '@sammo-ts/logic';
 
 import type { GameApiContext, InputJsonValue, WorldStateRow } from '../../context.js';
+import { purifyNationHtml } from '../../security/nationHtml.js';
 import { resolveSecretPermission } from '../shared/secretPermission.js';
 
 export type PermissionKind = 'normal' | 'ambassador' | 'auditor';
@@ -268,10 +269,10 @@ export const resolveNationBlockScout = (meta: Record<string, unknown>): boolean
     readMetaBool(meta, 'scout', readMetaBool(meta, 'blockScout', false));
 
 export const resolveNationNotice = (meta: Record<string, unknown>): string =>
-    typeof meta.notice === 'string' ? meta.notice : '';
+    purifyNationHtml(typeof meta.notice === 'string' ? meta.notice : '');
 
 export const resolveNationScoutMessage = (meta: Record<string, unknown>): string =>
-    typeof meta.infoText === 'string' ? meta.infoText : '';
+    purifyNationHtml(typeof meta.infoText === 'string' ? meta.infoText : '');
 
 export const resolveWarSettingRemain = (meta: Record<string, unknown>): number => {
     const legacy = readMetaNumber(meta, 'available_war_setting_cnt', -1);