feat(cfx-ui): allow html in connecting status

[csskroubledev]

Goal of this PR

Add support for using HTML code in connecting status e.g. deferral.update(), like rejection status can do (deferral.done()), allowing server developers to create more customized update statuses than Adaptive Cards can provide. (excluding inputs of course). ...

How is this PR achieving the goal

PR is replacing current implementation of showing the status message, to one similar to rejection status. ...

This PR applies to the following area(s)

FiveM, RedM ...

Successfully tested on

Game builds: 3258, 3095

Platforms: Windows

Checklist

• [x] Code compiles and has been tested successfully.
• [x] Code explains itself well and/or is documented.
• [x] My commit message explains what the changes do and what they are for.
• [x] No extra compilation warnings are added by these changes.

Fixes issues

Preview

I'm attaching a PoC of my change.

[AvarianKnight]

XSS?

[csskroubledev]

XSS?

I was informed that FiveM already prevents script tags from being used, an additionally html is allowed in connection rejection for a long time (used by txAdmin mostly).

I tried using those, and in fact didn’t succeed.

[csskroubledev]

XSS?

I was informed that FiveM already prevents script tags from being used, an additionally html is allowed in connection rejection for a long time (used by txAdmin mostly).

I tried using those, and in fact didn’t succeed.

Just to make sure, I have done some scenarios where an potential bad actor could abuse the HTML ability.

Code that was tested:

Video of checking it out: https://streamable.com/ceo6n8

[prikolium-cfx]

XSS?

I was informed that FiveM already prevents script tags from being used, an additionally html is allowed in connection rejection for a long time (used by txAdmin mostly).

I tried using those, and in fact didn’t succeed.

Did you try the way how txAdmin format connection status message? https://github.com/tabarra/txAdmin/blob/master/core/routes/player/checkJoin.ts#L26-L45

[csskroubledev]

XSS?

I was informed that FiveM already prevents script tags from being used, an additionally html is allowed in connection rejection for a long time (used by txAdmin mostly). I tried using those, and in fact didn’t succeed.

Did you try the way how txAdmin format connection status message? https://github.com/tabarra/txAdmin/blob/master/core/routes/player/checkJoin.ts#L26-L45

I might have a problem of understanding what do you mean by your message. Do you want me to check if the same code that txAdmin uses the reject works for updating statuses too?

If it's about that they sanitize the ban reason, it doesn't matter because every other resource can reject the connection trying to use some XSS stuff, even though they seem to be already sanitized somewhere in between sending data from resource -> cfx-ui, which was proven by my example in https://github.com/citizenfx/fivem/pull/3169#issuecomment-2668457095

[salam4n]

any progress here? would be useful tbh