SpongePowered / SpongeForge

A Forge mod that implements SpongeAPI
http://www.spongepowered.org/
MIT License
1.14k stars 306 forks source link

inventory tweaks DoS #2377

Closed gearkill closed 4 years ago

gearkill commented 6 years ago

I am currently running

the video below shows how any player can knock down a server using mod inventory tweaks

https://www.youtube.com/watch?v=3QSN10qfNuY

in new version it does not generate logs only the error [Server thread/WARN] [net.minecraft.server.MinecraftServer]: Can't keep up! Did the system time change, or is the server overloaded? Running 17608ms behind, skipping 352 tick(s) and hangs every console , I need to kill the process and start the script manually

https://hastebin.com/jawaduzeyo.sql

DiamondArrow commented 6 years ago

The issue he seems to be describing is Inventory Tweaks trying to sort items in GUIs. This causes the plugin to be constantly triggered and spams console with something like below before lagging or in his case, crashing from lag.

GTS: [03:44:30] [Server thread/INFO] [net.minecraft.server.dedicated.DedicatedServer]: Impactor API (Debug) Processing inventory click event for GearKillr... [03:44:30] [Server thread/INFO] [net.minecraft.server.dedicated.DedicatedServer]: Impactor API (Debug) Title: GTS » Listingsr [03:44:30] [Server thread/INFO] [net.minecraft.server.dedicated.DedicatedServer]: Impactor API (Debug) Provider: GTS-3.11.0-S7.1

VirtualChest using PlaceHolderAPI [03:44:33] [Server thread/WARN] [Sponge]: Could not find slot #%s in Container %s

He said this doesn't happened in sponge 3206

Aaron1011 commented 6 years ago

This sounds like it could be a bug in whatever plugin is responsible for managing that custom GUI.

To debug this further, I'll either need access to the plugin used in the video, or a way to reproduce the crash without using that plugin.

gearkill commented 6 years ago

so far I have tested only with the GTS and the virtual chest

Aaron1011 commented 6 years ago

Can you provide a series of step-by-step instructions for reproducing this, starting with only a plain SpongeForge server?

gearkill commented 6 years ago

https://drive.google.com/file/d/1AhaL_r7Nj7vXUiCsLkZ62ZaDnO2t_UHJ/view?usp=sharing in sponge 1.12.2-2705-7.1.0-BETA-3399 inventory tweaks + autoclick or macro

I think it gives you a better understanding of how it works

phit commented 5 years ago

so this is basically an event DoS, not sure what Sponge is supposed to do in this case

dualspiral commented 4 years ago

As this is two years old and it basically looks like Sponge can't do anything, I'm closing this. If this is still an issue, please create a new issue with up to date information and a minimal reproducable test case.

Thanks!