search

MattJeanes / Joystick-Module

A joystick module for GMod, originally by NightEagle.
13 stars 14 forks source link

Improve security #49

Closed dvdvideo1234 closed 2 years ago

dvdvideo1234 commented 2 years ago

Easier for you to review and merge: https://github.com/MattJeanes/Joystick-Module/pull/49/files?diff=unified&w=1

dvdvideo1234 commented 2 years ago

Please merge after my friend tests it in his server

MattJeanes commented 2 years ago

Looks pretty reasonable to me, what security is being improved here exactly?

dvdvideo1234 commented 2 years ago

My friend is a server owner and he is concerned string.find does not use safe patterns ( containing special characters ), so I optimized UID validation. The library method jcon.isValidUID now uses:

  1. Integer for loop with local reference when validating the UID
  2. Pattern safe character find call by enabling the plane search from 1-st character
  3. Pre-defined table with banned UID patterns ( they do not contain special symbols )
  4. Add forced validation character set so it can be used in the tool without mess up the serialization
  5. Skip creating character set and validation table on every call request

Only the tool will call the validation with second argument so the users can only enter pattern safe characters in the textbox.

MattJeanes commented 2 years ago

Okay, sounds good to me! Let me know when your friend has finished testing it, I'll take your word for it

MattJeanes commented 2 years ago

Also liking the conversion from tabs -> spaces, nice!

dvdvideo1234 commented 2 years ago

Made my personal primary test: image

dvdvideo1234 commented 2 years ago

@MattJeanes

image

Ok with me whenever you are ready ;)