search

CloudSixteen / Clockwork

A roleplaying framework developed by Cloud Sixteen for the people.
http://CloudSixteen.com
MIT License
44 stars 44 forks source link

CloudAuthX.WebPost can trigger a crash #528

Closed VortixDev closed 3 years ago

VortixDev commented 5 years ago 
CloudAuthX.WebPost("http://example.com/", "")

The line of code above can, sometimes, trigger a crash, though it's not clear to me what differentiates one call to this function from another such that one may cause a crash and the other will not. I have specifically tested with the URLs http://example.com, http://google.com, and http://api.steampowered.com.

This issue manifests in the Family Sharing Protection plugin, which can crash the server upon a player joining if the steam_api_key config has a non-empty value, due to its use of CloudAuthX.WebPost during the CheckPassword event.

sanny-io commented 4 years ago

I will fix this soon, or if anyone else wants to, the solution is to switch to use the regular http.* function in conjunction with game.KickID

https://wiki.garrysmod.com/page/game/KickID

kiobu commented 4 years ago

@sanny-io, still planning on resolving this, or should I/someone else do so?

sanny-io commented 4 years ago

I can no longer test the code for it, so I don't want to commit it. It shouldn't be much effort to get it working, however.

VortixDev commented 3 years ago

This has been fixed in the v1.0.0-beta branch, https://github.com/CloudSixteen/Clockwork/commit/f15a9e14b5350ea96c14d0344a03e354face42e6 and https://github.com/CloudSixteen/Clockwork/commit/883141add143768dcd75889a72a81bb29f095994. WebFetch should have been used originally, but the WebPost issue has been fixed in the updated CAX (CWUtil) module - it was due to attempting to split the data field into key-value groups via & splitting and then separate the keys and values via = splitting. When no = is present, this can cause a crash.