Summary

The "Change Currency Symbol" / "Change Currency Name" modals in /economy dashboard only validate input length (1-3 / 1-20 chars), then interpolate the raw value directly into src/config/bot.js's source code via string templates before writing it to disk.

A value containing a double quote — e.g. ",a (3 characters, passes the length check) — breaks the generated JS syntax. Since bot.js is imported at process startup, this corrupts the bot's central config file and the bot fails to start on the next restart/redeploy until someone manually fixes the file.

Fix

• Serialize the symbol/name with JSON.stringify() instead of raw template interpolation, so quotes/backslashes are always properly escaped in the generated source (defense in depth).
• Add an explicit character whitelist (isSafeCurrencyInput) that rejects quotes, backslashes, and backticks up front, giving admins a clear validation error instead of relying solely on escaping.

Test plan

• node --check on the modified file — syntax valid
• Standalone repro script confirming the exact exploit payload (",a) is now rejected by validation, and that even bypassing validation, JSON.stringify() prevents the generated bot.js from breaking (verified new Function() still parses the patched output)
• Confirmed normal inputs ($, €, ¥, coins, gem) are unaffected and still produce valid output

🤖 Generated with Claude Code