From 74bbace3face0cd571209bf47768d6f190509547 Mon Sep 17 00:00:00 2001
From: bigjakk <cjackson@jacksonchris.com>
Date: Fri, 10 Apr 2026 13:20:01 -0700
Subject: [PATCH] fix: escape external data in matchmaker and changelog to
 prevent XSS

---
 src/preload/changelog.ts  | 18 +++++++++++++++---
 src/preload/matchmaker.ts |  8 ++++----
 2 files changed, 19 insertions(+), 7 deletions(-)

diff --git a/src/preload/changelog.ts b/src/preload/changelog.ts
index 3d30cde..fa99a3e 100644
--- a/src/preload/changelog.ts
+++ b/src/preload/changelog.ts
@@ -2,6 +2,7 @@
 // Shows release notes in a Shadow DOM modal when the client version changes.
 
 import { ipcRenderer } from 'electron';
+import { escapeHtml } from './utils';
 
 function versionLessThan(a: string, b: string): boolean {
     const pa = a.split('.').map(Number);
@@ -16,14 +17,25 @@ function versionLessThan(a: string, b: string): boolean {
     return false;
 }
 
+function sanitizeUrl(url: string): string {
+    try {
+        const parsed = new URL(url);
+        if (parsed.protocol === 'https:' || parsed.protocol === 'http:') return escapeHtml(url);
+    } catch { /* invalid URL */ }
+    return '#';
+}
+
 function renderMarkdown(md: string): string {
-    const html = md
+    // Escape all HTML first, then apply markdown formatting to the safe text
+    const escaped = escapeHtml(md);
+    const html = escaped
         .replace(/### (.+)/g, '<h3>$1</h3>')
         .replace(/## (.+)/g, '<h2>$1</h2>')
         .replace(/# (.+)/g, '<h1>$1</h1>')
         .replace(/\*\*(.+?)\*\*/g, '<strong>$1</strong>')
         .replace(/\*(.+?)\*/g, '<em>$1</em>')
-        .replace(/\[([^\]]+)\]\(([^)]+)\)/g, '<a href="$2" target="_blank">$1</a>');
+        .replace(/\[([^\]]+)\]\(([^)]+)\)/g, (_m, text, url) =>
+            `<a href="${sanitizeUrl(url)}" target="_blank">${text}</a>`);
 
     // Convert list items
     const lines = html.split('\n');
@@ -94,7 +106,7 @@ function showChangelogPopup(version: string, body: string): void {
 
     const header = document.createElement('div');
     header.className = 'header';
-    header.innerHTML = `<h2>What's New in v${version}</h2>`;
+    header.innerHTML = `<h2>What's New in v${escapeHtml(version)}</h2>`;
     const closeBtn = document.createElement('button');
     closeBtn.className = 'close-btn';
     closeBtn.textContent = '\u2715';
diff --git a/src/preload/matchmaker.ts b/src/preload/matchmaker.ts
index b60fdac..8e1341c 100644
--- a/src/preload/matchmaker.ts
+++ b/src/preload/matchmaker.ts
@@ -5,7 +5,7 @@
 
 import { ipcRenderer } from 'electron';
 import type { Keybind } from '../main/config';
-import type { SavedConsole } from './utils';
+import { escapeHtml, type SavedConsole } from './utils';
 
 // Full array — indices must match the server's gamemode IDs (game[4].g)
 export const MATCHMAKER_GAMEMODES = ['Free for All', 'Team Deathmatch', 'Hardpoint', 'Capture the Flag', 'Parkour', 'Hide & Seek', 'Infected', 'Race', 'Last Man Standing', 'Simon Says', 'Gun Game', 'Prop Hunt', 'Boss Hunt', 'Classic FFA', 'Deposit', 'Stalker', 'King of the Hill', 'One in the Chamber', 'Trade', 'Kill Confirmed', 'Defuse', 'Sharp Shooter', 'Traitor', 'Raid', 'Blitz', 'Domination', 'Squad Deathmatch', 'Kranked FFA', 'Team Defender', 'Deposit FFA', 'Chaos Snipers', 'Bighead FFA'];
@@ -242,7 +242,7 @@ function showResultPopup(game: MatchmakerGame): void {
     } else {
         popupTitle.innerText = 'Game Found!';
         const regionName = MATCHMAKER_REGION_NAMES[game.region] ?? 'Unknown Region';
-        popupDescription.innerHTML = `${game.gamemode} on ${game.map} (${regionName})<br/>${game.playerCount}/${game.playerLimit} Players, ${secondsToTimestring(game.remainingTime)} Left`;
+        popupDescription.innerHTML = `${escapeHtml(game.gamemode)} on ${escapeHtml(game.map)} (${escapeHtml(regionName)})<br/>${game.playerCount}/${game.playerLimit} Players, ${secondsToTimestring(game.remainingTime)} Left`;
         popupConfirmBtn.style.display = 'block';
     }
 
@@ -438,8 +438,8 @@ export async function fetchGame(mmConfig: MatchmakerConfig, _con?: SavedConsole)
             found.className = 'mm-feed-entry mm-pass';
             found.style.cssText = 'font-size:1.1em;justify-content:center;';
             found.innerHTML =
-                `<span class="mm-feed-region">${best.region}</span>` +
-                `<span class="mm-feed-map">${best.map}</span>` +
+                `<span class="mm-feed-region">${escapeHtml(best.region)}</span>` +
+                `<span class="mm-feed-map">${escapeHtml(best.map)}</span>` +
                 `<span class="mm-feed-players">${best.playerCount}/${best.playerLimit}</span>`;
             searchFeed.appendChild(found);
             searchCounter.textContent = `${best.gamemode} \u00B7 ${regionName} \u00B7 ${pings[best.region] ?? '?'}ms`;