Open ubitux opened 4 years ago
re the second point: one of the core features of OpenRA's MiniYaml is that types are set by the parser (which maps the tree structure onto predefined C# classes), not the data.
I suspect that a better solution to your problem will be to expose a parameter or endpoint that returns json instead of MiniYaml.
Adding an endpoint that returns json is relatively easy. We just need decide what the endpoint should be. And if this API keeps growing we should think about documenting it in the long-term.
The exposed YAML is currently only valid with the custom dialect implementation in OpenRA. External tools currently need to re-implement the whole parser. Here are the 2 main (and only?) issues:
Tabs/spaces
The exposed YAML uses tabs instead of spaces; this is not valid:
Source: yaml.org
I believe the OpenRA parser does handle spaces as well so this should be easy to fix.
Unquoted strings
The
ProfileName
contains arbitrary data from the users. I'm not sure how much is allowed from phpbb, but I know that at least Unicode (to some extent?) is permitted. This means that there is a potential corruption vector here to alter the implied type.One example of this is user ".1" (pointwon). Using a standard YAML parser will recognize the value as a float, meaning it will be recognized as
0.1
. This could imply all kind of various issues. We could technically have integers as well, and maybe other types such as lists (comma and linebreaks are allowed?).One possible fix for this would be to quote the string, but I'm not sure OpenRA code can handle this. Also, what would happen with a
\
or a"
in the name, is that possible?Also, while there is probably a filter in phpbb, I see no such thing while displaying it (no escaping), this might be another problem.