DJS parsing

[full canopy]

does DJS parse inputs from stuff like user tag to prevent exploits?

[crude geode]

• What's your exact discord.js npm list discord.js and node node -v version?
• Not a discord.js issue? Check out #1081585952654360687.
• Consider reading #how-to-get-help to improve your question!
• Explain what exactly your issue is.
• Post the full error stack trace, not just the top part!
• Show your code!
• Issue solved? Press the button!
• ✅ Marked as resolved by OP

[jaunty ravine]

What exploit?

Never heard of preventing an exploiting from parsing it

[little drum]

if you mean like, sql injection, then no it doesn't strip anything, that'd be unexpected behavior for most users

it should be safe to use ids directly however since that's not user input

but generally it's better to go for the safe route

[full canopy]

stuff like format string breakout, the one i'm specifically thinking of is user tags

[little drum]

I'm not getting it

[full canopy]

like if you have a string like console.log(`tag ${user.tag}`) you can breakout of that with the right input

[little drum]

you can't though?

[full canopy]

and that can lead to RCE

[little drum]

unless you're evalling that input

and at that point they can do anything

[full canopy]

ok maybe not in that example, but other inputs you can

[full canopy]

true

[little drum]

it's just a string, they can't make the string do anything by itself

the only thing that can happen is if you then use that string somewhere else

eg sql injection

[full canopy]

ah ok that makes sense

i just realized i was thinking more about C printf exploits not js

[little drum]

oh yeah that exploit would make sense in C

in js it'd just be treated as a regular string, even if it contains ${} and it's inside ``

[full canopy]

ahhh ok that makes sense