With the use of APIs, it is possible to obtain a user’s following date, with additional stuff to add to it, you can make nightbot say something that is completely irrelevant to the command being used.
For example, normally: !followage test
would say something like Test has been following Streamer for 4 months, 9 days, 3 hours, 10 seconds.
But with the ?format
tag, it’s possible to add additional text to it. For example: !followage test?format=\t\h\e%20\d\a\w\n%20\o\f%20\t\h\e%20\U\n\i\v\e\r\s\e&
would turn to be: Test has been following Streamer since the dawn of the Universe
. Adding notext&
to the end of what I said above turns the response into: the dawn of the Universe
This seems malicious as it can generate any text (unsure if ascii works)
This works with /me but any other command displays a fail safe; Server commands other than /me are blocked. '
It doesn’t seem this can be used maliciously to use any command such as banning random people, but it could be used to bypass a channel’s moderation filters, which seems pretty bad