Post

If you are worried about this, simply go in your chat and type: <b>TEST</b> Check how the message is displayed in the overlays! -If you see a BOLD "TEXT", disabling the browser source until an OBS patch will fix that. ⚠ -If you simple see, "<b>TEST</b>", you are all good! ✨

I feel like this is something that would need to be patched by the individual overlay web dev rather than something OBS should ever integrate into CEF. I've written my own overlay before, and as long as you're sanitizing the text you display instead of using it as raw contents, you should be fine..

Preventing additional JS from being parsed could possibly be done by modifying CEF, but it may cause quite a few issues with existing sources/overlays & wouldn't be as wise as informing developers about etiquette for displaying user-submitted data, since the issue will persist with other browsers.

also i have, as a bit, intentionally just let people write HTML via chat into an extremely rudimentary overlay with rolling DIVs (messages older than 10 would be removed) and it kinda ruled, but i had to be extremely careful with who had access to being parsed.

I thought of doing that in the past! For having fun text (bold, italic, HUGE, etc...) but thought it would be way too easy to exploit without proper moderation. Very unfortunate that people did find an exploit to it as of now tho

If you have a whitelist for users to have permission for it, it's definitely a lot less of a concern (since you can set it to only allow permitted users to be parsed directly while the rest are sanitized & only displayed as text), but it might not be as exciting/dangerous as allowing just anyone to.

Phil Collins' music 😥