search

minetest-mods / irc

IRC Mod for Minetest
BSD 2-Clause "Simplified" License
43 stars 31 forks source link

Enforce a message size limit #53

Open luk3yx opened 6 years ago

luk3yx commented 6 years ago

Forces all messages to be at most 512 bytes, to stop cmd help all from the irc_commands DoSing the server (making it quit with the message RecvQ exceeded).

This is done in the core IRC mod so it limits everything rather than just irc_commands.

Credit to @bigfoot547 for finding this vulnerability.

sofar commented 5 years ago

Yes, but, can we please maybe get some logging in the console as well if players want to cause floods this way? Silently dropping output may also cause unintentional side effects, so we should consider replying back with an error message and throttling the user for at least a few seconds, too.

luk3yx commented 5 years ago

What about adding ... to the end of long messages?

PRIVMSG #channel :A really long testing messag...
sofar commented 5 years ago

I'd almost favor dropping the message and sending an error to the client. That may help prevent floods.

luk3yx commented 5 years ago

That would need a change somewhere else, there may be rouge irc.say()-s in other mods that need fixing too.