[commands] Fix clean_content converter not properly escaping mentions.

In some cases, the Discord provided role_mentions and mentions array
would be empty, such as wrapping a mention with a backtick or
other frivolous characters. Since we want to completely nullify
mentions, we should not rely on the Discord provided arrays and instead
use and resolve the IDs from the content itself.

1 files changed, 29 insertions, 24 deletions

diff --git a/discord/ext/commands/converter.py b/discord/ext/commands/converter.py
index b109765b..df34f47f 100644
--- a/discord/ext/commands/converter.py
+++ b/discord/ext/commands/converter.py
@@ -381,38 +381,43 @@ class clean_content(Converter):
         message = ctx.message
         transformations = {}
 
-        if self.fix_channel_mentions:
-            transformations.update(
-                ('<#%s>' % channel.id, '#' + channel.name)
-                for channel in message.channel_mentions
-            )
+        if self.fix_channel_mentions and ctx.guild:
+            def resolve_channel(id, *, _get=ctx.guild.get_channel):
+                ch = _get(id)
+                return ('<#%s>' % id), ('#' + ch.name if ch else '#deleted-channel')
 
-        if self.use_nicknames:
-            transformations.update(
-                ('<@%s>' % member.id, '@' + member.display_name)
-                for member in message.mentions
-            )
+            transformations.update(resolve_channel(channel) for channel in message.raw_channel_mentions)
 
-            transformations.update(
-                ('<@!%s>' % member.id, '@' + member.display_name)
-                for member in message.mentions
-            )
+        if self.use_nicknames and ctx.guild:
+            def resolve_member(id, *, _get=ctx.guild.get_member):
+                m = _get(id)
+                return '@' + m.display_name if m else '@deleted-user'
         else:
-            transformations.update(
-                ('<@%s>' % member.id, '@' + member.name)
-                for member in message.mentions
-            )
+            def resolve_member(id, *, _get=ctx.bot.get_user):
+                m = _get(id)
+                return '@' + m.name if m else '@deleted-user'
 
-            transformations.update(
-                ('<@!%s>' % member.id, '@' + member.name)
-                for member in message.mentions
-            )
 
         transformations.update(
-            ('<@&%s>' % role.id, '@' + role.name)
-            for role in message.role_mentions
+            ('<@%s>' % member_id, resolve_member(member_id))
+            for member_id in message.raw_mentions
+        )
+
+        transformations.update(
+            ('<@!%s>' % member_id, resolve_member(member_id))
+            for member_id in message.raw_mentions
         )
 
+        if ctx.guild:
+            def resolve_role(id, *, _find=discord.utils.find, _roles=ctx.guild.roles):
+                r = _find(lambda x: x.id == id, _roles)
+                return '@' + r.name if r else '@deleted-role'
+
+            transformations.update(
+                ('<@&%s>' % role_id, resolve_role(role_id))
+                for role_id in message.raw_role_mentions
+            )
+
         def repl(obj):
             return transformations.get(obj.group(0), '')