Stored XSS in Rocket.Chat HTML File Export — Unauthenticated Entry via LiveChat

Rocket.Chat's HTML file export feature (`rooms.export` API, `type=file`, `format=html`) writes message content and metadata directly into HTML output without any sanitization or entity encoding. An attacker — including an **unauthenticated** LiveChat visitor — can inject arbitrary JavaScript that …

const message = italicTypes.includes(messageType)
  ? `<i>${messageObject.msg}</i>`
  : messageObject.msg;

file.push(`<p><strong>${messageObject.username}</strong> (${timestamp}):<br/>`);
file.push(message);