How do I properly avoid the usage of a delimiter in a custom string?
<p>I am currently working on a Discord Bot that interacts with my gameserver through rcon and came across a problem.</p>

<p>I have two functions. This is for the bot to recognize a command (e.g. '.say Hello World')</p>

<pre><code>@bot.command(pass_context=True, aliases=[])
@asyncio.coroutine
def say(context, *, msg):
yield from bot.say("```{0}```".format(rcon.rcon_say(msg)))
</code></pre>

<p>The second function sends it to my gameserver. In this case 'say Hello World' wich will make the server say 'Hello World' into the chat.</p>

<pre><code>def rcon_say(_msg : str):
with RCON(SERVER_ADDRESS, PASSWORD) as rcon:
    return rcon("say {0}".format(_msg))
</code></pre>

<p>The problem: .say "test; kick user1" will send two commands to the server:</p>

<pre><code> say test
 kick user1
</code></pre>

<p>so its abusable with any other rcon command. So how to avoid this from beeing abused?</p>

<p>What I did to avoid abusage:</p>

<p>I added following function:</p>

<pre><code>def checkMsg(checkThis : str):
if ";" in checkThis:
    raise errors.SemicolonError()
    return
else:
    return checkThis
</code></pre>

<p>And added </p>

<pre><code> _msg = checkMsg(_msg)
</code></pre>

<p>So this will remove any semicolons from the users input but I somehow don't feel like it's the right way to do this. Is it still possible to send a semicolon (maybe decoded/ in unicode etc.)</p>

<p>Am I safe or is there a way of abusing it?</p>

<p>you should instead make your delimiter an unprintable character like <code>'\x00'</code> ... that would easily solve the issue ...</p>

python security python-3.5