Skip to content

Add checks to GameMessage::MSG_SET_BEACON_TEXT #2767

@Caball009

Description

@Caball009

case GameMessage::MSG_SET_BEACON_TEXT:
{
if( currentlySelectedGroup )
{
const VecObjectID& selectedObjects = currentlySelectedGroup->getAllIDs();
for (VecObjectID::const_iterator it = selectedObjects.begin(); it != selectedObjects.end(); ++it)
{
Object *beacon = findObjectByID(*it);
if (beacon)
{
Drawable *beaconDrawable = beacon->getDrawable();
if (beaconDrawable)
{
UnicodeString s;
for( int i=0; i<msg->getArgumentCount(); i++ )
{
s.concat( msg->getArgument(i)->wChar );
}
if (s.isEmpty())
beaconDrawable->clearCaptionText();
else
beaconDrawable->setCaptionText(s);
}
}
}
}
break;
}

GameMessage::MSG_SET_BEACON_TEXT could use a couple of checks:

  • verify that selected object is a beacon.
  • lower the max char count from 255 (the max argument count) to a more acceptable number.
  • sanitize string; e.g. new line characters should be ignored.
  • limit the number of changes; e.g. once every 10 seconds or max 10 changes.

Metadata

Metadata

Assignees

No one assigned

    Labels

    MinorSeverity: Minor < Major < Critical < BlockerSecurityIs security related

    Type

    No fields configured for Bug.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions