search

guyver2 / battlechess

Chess with Battleship modification. You can only see around your pieces.
3 stars 4 forks source link

Remove information leakage on movement error #23

Open quimnuss opened 3 years ago

quimnuss commented 3 years ago

ATM Board gives different error messages if one player tries to move and is blocked, the piece isn't his etc. Potentially, a player could send a move on an enemy square and know wether there's a piece there or not.

These messages are very nice for debugging, but should be silenced/uniformized in "production" mode.

guyver2 commented 3 years ago

what messages are you refering to exactly? If you're talking about the server's log that's fine, if it's something that goes through the API and served to the client, yes it is an issue.

quimnuss commented 3 years ago

when a move is not possible the backend adds a message as to why. Maybe this could be exploited. Maybe not. Easy fix is to not provide this msg info, althought it is useful for debugging atm.

On Fri, Jun 11, 2021 at 12:42 PM Pol Monsó Purtí @.***> wrote:

when a move is not possible the backend adds a message as to why. Maybe this could be exploited. Maybe not. Easy fix is to not provide this msg info, althought it is useful for debugging atm.

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/guyver2/battlechess/issues/23#issuecomment-859490613, or unsubscribe https://github.com/notifications/unsubscribe-auth/AA74OCNWFZWJHCLSQTAMQPDTSHSAPANCNFSM45LAWQXQ .

guyver2 commented 3 years ago

let's leave it for now and keep this ticket open for when we're out of the debug phase