Luke100000 / ImmersiveArmors

Unique vanilla-friendly armor sets for Minecraft
GNU General Public License v3.0
11 stars 17 forks source link

Avoid use of ObjectInput/OutputStream in packets #68

Closed Ampflower closed 1 year ago

Ampflower commented 1 year ago

Why?

Java's native serialisation is inherently unsafe and shouldn't be used in untrusted environments, which includes any Minecraft client and server, for as there's no guard to prevent anyone from defining something invalid, crashing the network layer as a result, or presenting more severe exploits.

Problems this causes

Replacements

Use a container such as NBT or manually encode into the packet.

NBT would provide an entirely stable ABI that is both forward and backwards compatible, assuming the code for it remains in place.

Encoding into the packet will let you define the compatibility to a finer degree, while still preventing exploits.

Both solutions, as long as you're not trusting with arbitrary execution of methods (raw reflection lookups), will provide much stronger protocol compatibility across JVMs and environments, while also hardening the mod from any attacks that may take advantage of network-exposed Object streams.

Offending lines

https://github.com/Luke100000/ImmersiveArmors/blob/f5262e4d016d8b9e298afc43961b3fcd2df84ff0/common/src/main/java/immersive_armors/cobalt/network/Message.java#L14 https://github.com/Luke100000/ImmersiveArmors/blob/f5262e4d016d8b9e298afc43961b3fcd2df84ff0/common/src/main/java/immersive_armors/cobalt/network/Message.java#L24