devsam/core2026
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: purify nation-authored HTML at server boundaries

Browse Source
This commit is contained in:
Hide_D
2026-07-31 06:41:09 +00:00
parent 71ec02d091
commit 243f58be9a
16 changed files with 898 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/game-api/src/router/nation/shared.ts
+3 -2
View File
@@ -27,6 +27,7 @@ import {
} from '@sammo-ts/logic';
import type { GameApiContext, InputJsonValue, WorldStateRow } from '../../context.js';
import { purifyNationHtml } from '../../security/nationHtml.js';
import { resolveSecretPermission } from '../shared/secretPermission.js';
export type PermissionKind = 'normal' | 'ambassador' | 'auditor';
@@ -268,10 +269,10 @@ export const resolveNationBlockScout = (meta: Record<string, unknown>): boolean
readMetaBool(meta, 'scout', readMetaBool(meta, 'blockScout', false));
export const resolveNationNotice = (meta: Record<string, unknown>): string =>
typeof meta.notice === 'string' ? meta.notice : '';
purifyNationHtml(typeof meta.notice === 'string' ? meta.notice : '');
export const resolveNationScoutMessage = (meta: Record<string, unknown>): string =>
typeof meta.infoText === 'string' ? meta.infoText : '';
purifyNationHtml(typeof meta.infoText === 'string' ? meta.infoText : '');
export const resolveWarSettingRemain = (meta: Record<string, unknown>): number => {
const legacy = readMetaNumber(meta, 'available_war_setting_cnt', -1);