sanitizing text for shell command, limiting max size

core/messages.go

@@ -10,6 +10,45 @@ import (
 	"github.com/bwmarrin/discordgo"
 )
 
+// source on www.socketloop.com
+func removeCharacters(input string, characters string) string {
+	filter := func(r rune) rune {
+		if strings.IndexRune(characters, r) < 0 {
+			return r
+		}
+		return -1
+	}
+	return strings.Map(filter, input)
+}
+
+// https://stackoverflow.com/questions/34839659/how-can-i-easily-get-a-substring-in-go-while-guarding-against-slice-bounds-out
+func maxString(s string, max int) string {
+	if len(s) > max {
+		r := 0
+		for i := range s {
+			r++
+			if r > max {
+				return s[:i]
+			}
+		}
+	}
+	return s
+}
+
+func createAudio(msg string) ([]byte, error, string) {
+	curr_time := time.Now().Unix()
+	var filename string = fmt.Sprintf("/tmp/%d.mp3", curr_time)
+	var cmd_args string = fmt.Sprintf("espeak-ng -s 120 -v mb-fr2 -p 30 '%s' -w %s",
+		maxString(msg, 300),
+		filename)
+	cmd := exec.Command("sh", "-c", cmd_args)
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		fmt.Println(fmt.Sprint(err) + ": " + string(out))
+	}
+	return out, err, filename
+}
+
 func MessagePing(s *discordgo.Session, m *discordgo.MessageCreate) {
 	// Ignore all messages created by the bot itself
 	// This isn't required in this specific example but it's a good practice.
@@ -30,25 +69,11 @@ func MessageAudio(s *discordgo.Session, m *discordgo.MessageCreate) {
 	if m.Author.ID == s.State.User.ID {
 		return
 	}
-
 	var prefix string = "/gogodisco audio"
 	if strings.HasPrefix(m.Content, prefix) {
-		var message string = strings.TrimLeft(m.Content, prefix)
-		_, _, filename := createAudio(message)
-		// func (s *Session) ChannelFileSend(channelID, name string, r io.Reader) (*Message, error)
+		var message string = strings.TrimPrefix(m.Content, prefix)
+		_, _, filename := createAudio(removeCharacters(message, "-\"'`$();:."))
 		file, _ := os.Open(filename)
 		s.ChannelFileSend(m.ChannelID, filename, file)
 	}
 }
-
-func createAudio(msg string) ([]byte, error, string){
-	curr_time := time.Now().Unix()
-	var filename string = fmt.Sprintf("/tmp/%d.mp3", curr_time)
-	var cmd_args string = fmt.Sprintf("espeak-ng -s 120 -v mb-fr2 -p 30 %q -w %s", msg, filename)
-	cmd := exec.Command("sh","-c", cmd_args)
-	out, err := cmd.CombinedOutput()
-	if err != nil {
-		fmt.Println(fmt.Sprint(err) + ": " + string(out))
-	}
-	return out, err, filename
-}