diff --git a/files/helpers/const.py b/files/helpers/const.py
index affc0673b5..7d0b2fe9da 100644
--- a/files/helpers/const.py
+++ b/files/helpers/const.py
@@ -88,9 +88,9 @@ if SITE_NAME == 'rDrama':
"pedocord": "discord (actually a pretty cool service)",
"i hate carp": "i love Carp",
"manlet": "little king",
- "gamer": "g\*mer",
- "journalist": "journ\*list",
- "journalism": "journ\*lism",
+ "gamer": "g*mer",
+ "journalist": "journ*list",
+ "journalism": "journ*lism",
"wuhan flu": "SARS-CoV-2 syndemic",
"china flu": "SARS-CoV-2 syndemic",
"china virus": "SARS-CoV-2 syndemic",
diff --git a/files/helpers/sanitize.py b/files/helpers/sanitize.py
index 66deb27993..d45cec26ef 100644
--- a/files/helpers/sanitize.py
+++ b/files/helpers/sanitize.py
@@ -79,8 +79,17 @@ def allowed_attributes(tag, name, value):
url_re = build_url_re(tlds=TLDS, protocols=['http', 'https'])
def callback(attrs, new=False):
+ if (None, "href") not in attrs:
+ return # Incorrect tag
+
href = attrs[(None, "href")]
+ # \ in href right after / makes most browsers ditch site hostname and allows for a host injection bypassing the check, see cool
+ if "\\" in href:
+ attrs["_text"] = href # Laugh at this user
+ del attrs[(None, "href")] # Make unclickable and reset harmful payload
+ return attrs
+
if not href.startswith('/') and not href.startswith(f'{SITE_FULL}/'):
attrs[(None, "target")] = "_blank"
attrs[(None, "rel")] = "nofollow noopener noreferrer"
@@ -124,6 +133,7 @@ def render_emoji(html, regexp, edit, marseys_used=set(), b=False):
if emoji_html:
+ marseys_used.add(emoji)
html = re.sub(f'(?