Post

Jall | PLAY UNUSUAL TALES ✨
@jall.live

If you are worried about this, simply go in your chat and type: <b>TEST</b> Check how the message is displayed in the overlays! -If you see a BOLD "TEXT", disabling the browser source until an OBS patch will fix that. ⚠ -If you simple see, "<b>TEST</b>", you are all good! ✨

This post is unavailable.

370 reposts480 likes

ompuco
@ompu.co

I feel like this is something that would need to be patched by the individual overlay web dev rather than something OBS should ever integrate into CEF. I've written my own overlay before, and as long as you're sanitizing the text you display instead of using it as raw contents, you should be fine..

ompuco
@ompu.co

Preventing additional JS from being parsed could possibly be done by modifying CEF, but it may cause quite a few issues with existing sources/overlays & wouldn't be as wise as informing developers about etiquette for displaying user-submitted data, since the issue will persist with other browsers.

ompuco
@ompu.co

also i have, as a bit, intentionally just let people write HTML via chat into an extremely rudimentary overlay with rolling DIVs (messages older than 10 would be removed) and it kinda ruled, but i had to be extremely careful with who had access to being parsed.

Jall | PLAY UNUSUAL TALES ✨
@jall.live

I thought of doing that in the past! For having fun text (bold, italic, HUGE, etc...) but thought it would be way too easy to exploit without proper moderation. Very unfortunate that people did find an exploit to it as of now tho

Jall | PLAY UNUSUAL TALES ✨
@jall.live

Luckily a LOT of overlays are not that bad! But I would be weary especially with how some of them could be vibecoded and what not, just processing the HTML itself instead of raw text.

Taw - Play Tailraise!
@a-bat.com

Yeah, many of them in theory should be fine and should properly have been built with security in mind, especially more reputable and well known widgets and overlays. I did a quick check and saw all of mine are fine and took the time to remove a few old browser sources to clean up anything unused.

Jo Seph GD
@josephgd.bsky.social

that means it's encoding special characters to their HTML code counterparts to prevent XSS attacks from being formatted in a way that HTML can understand this is a valid form of sanitization, and it does mean that your overlay is safe

AnXLGay
@xlentgay.bsky.social

The video I saw used the !image command so maybe blocking that would work as well. I just don't like StreamElements for their yikes take so I just say yeet it.

Melodie ^-^
@mel0cious.bsky.social

this isn't new? I mean, I made my own twitch chat browser source and noticed it was vulnerable to a XSS attack. thats up to the dev to fix imo

Katzentatzentanz
@foxgirl.codes

Heya this is kinda just wrong. The vulnerability that actually pwns you has nothing to do with chat, this protects you from Xss, not from streamelements or whatever you are using making your pc run code that could lead to getting pwned. + That can happen in so many flavors beyond just xss too.

Socks the Macro Wolf Dad
@socksthewolf.com

The OBS update doesn't fix the DOM sink, it fixes the memory corruption which allows for the RCE to work. So the sources in question need to be fixed regardless, as someone can use the power of dicking around to make your stream start showing slurs or porn...or TOS explosions.