search

poggit-orphanage / WorldProtect

Griefer protection plugin
GNU General Public License v2.0
11 stars 20 forks source link

Alias/Format attacks #28

Closed NhanAZ closed 2 years ago

NhanAZ commented 2 years ago

https://github.com/poggit-orphanage/WorldProtect/blob/dev/src/aliuly/worldprotect/BanCmd.php#L80-L96

This violates S4: Use permissions to block commands. Do not use PlayerCommandPreprocessEvent/CommandEvent to block users from running commands. This is vulnerable to alias attacks and formatting attacks.

I think this should be fixed

NhanAZ commented 2 years ago

@supercrafter333 Looks like you are the maintainer of this plugin. I want to ask when this problem will be fixed

NhanAZ commented 2 years ago

Btw ... @JaxkDev Why does this plugin violate S4 but it continues to be approved?

JaxkDev commented 2 years ago

Btw ... @JaxkDev Why does this plugin violate S4 but it continues to be approved?

Because that code was reviewed and approved way before that rule was introduced, If we looked at the entire plugin and review the entire thing from scratch for every update the review times would be 100x longer

NhanAZ commented 2 years ago

This does not seem necessary. That's just an optional feature anyway.