New freeze exploits - Githubissues

ac-minetest / basic_robot

Write mods without server restart while playing. Create custom machines that can build, dig, produce... Create your own games like minesweeper, sokoban,ctf, hide and seek...

26 stars 21 forks source link

New freeze exploits #7

Closed raymoo closed 6 years ago

raymoo commented 7 years ago

Note: this is not a replacement for #5, which should be resolved separately

[ ] Introduced by your recent fix
```
meme = "\""
while true do end
meme = ""
```
[ ] Existed before
```
while "do nut steal" do end
```

ac-minetest commented 7 years ago

Im sure you can find bugs if you try hard enough.. i dont have time for this (no rewards) plus the mod is not intended for exploiters. Go fix bugs if you have time..

btw: why limit your self to easy stuff like this, go and prove that lua sandboxing is foolproof and cant be broken, also pcalls..

raymoo commented 7 years ago

the mod is not intended for exploiters

I'm assuming this is intended for use on servers, and server owners won't want their server to be easily frozen by a random player. If this was intended solely as a singleplayer mod, then I'm sorry for wasting your time.

btw: why limit your self to easy stuff like this, go and prove that lua sandboxing is foolproof and cant be broken, also pcalls..

Just because you can't show that exploits don't exist at all doesn't mean you shouldn't patch the ones that you can.

Go fix bugs if you have time..

Debug count hooks would kill all "infinite loop" bugs. Would you accept patches changing the mod to use them for execution limiting?

From https://github.com/ac-minetest/basic_robot/issues/5#issuecomment-263077229:

is fun solving challenges you provide. Keep them coming :)

I'm only doing what you asked.

raymoo commented 7 years ago

Also, while you're on, could you please reopen #5? Not all of the exploits have been fixed.

ac-minetest commented 6 years ago

redo of string parsing

raymoo commented 6 years ago

Haven't had a chance to test anything, but from the code there are a couple things you might want to fix:

Strings enclosed by single quotes can contain escaped single quotes (for example '\''), but your code assumes that only double quotes can do this
Your code will count a string starter like [=[ to be closed by something like ]====] even though they have a different number of equals characters. This would let an attacker do something like this:
```
[=[ ]==]"]=]
-- Everything here will be marked as inside of a string.
```

Hope this helps.