HTML bug after 06/06/2024 update

[Matarruano]

 

[phplordu]

where is the bug exactly?

 

[rose]

where is the bug exactly?

Ability pings used html spanning to work within Source 2's panorama UI (which is mostly html). The patch today removed an exploit allowing you to inject your own html and broke the existing usage.

 

[phplordu]

I dont see any injected html here. Probably they made a function to sanitize the html. (Example https://www.php.net/manual/en/function.htmlspecialchars.php)

 

[Amni3D]

I saw the same exact bug. Was something like "Heading To Blue" with a bunch of formatting strings in text chat.
This update was the only time I've seen it happen.
I didn't take a screenshot, but I'm glad someone else caught it too
Match ID: 61273

 

[rose]

I dont see any injected html here. Probably they made a function to sanitize the html. (Example https://www.php.net/manual/en/function.htmlspecialchars.php)

Yes... that's what I said. The injected html is gone but the intended one (blue text in chat when you ping something to differentiate it from chat) is broken

 

[g0ldensp00n]

Yea seems like they are sanitizing their own HTML too. I noticed all the colored ping and call outs show without the HTML theming applied to them.

 

[phplordu]

Yes... that's what I said. The injected html is gone but the intended one (blue text in chat when you ping something to differentiate it from chat) is broken

oooh sorry I man i get it now