search

unmojang / drasl

Yggdrasil-compatible API server for Minecraft
GNU General Public License v3.0
119 stars 20 forks source link

There is a security risk: Cannot choose whether to enable URL to obtain skins #116

Open Sa9iri opened 3 days ago

Sa9iri commented 3 days ago

Cannot choose whether to enable URL to obtain skins.

This is a security risk, and it is recommended that users can choose to turn off this feature. It should also support manually adding address filters for skin sources.

evan-goode commented 3 days ago

I agree, this functionality should be opt-in or removed entirely.

evan-goode commented 3 days ago

It should also support manually adding address filters for skin sources.

Maybe, that might be a little too feature-creep-y. The point of setting textures via URLs is to make the UX of changing skins more seamless, and you might as well just download/upload the skin file if you have to also check that your URL is allowed by the Drasl instance.

Something like a skin library that could integrate with Drasl would be better served by fleshing out the Drasl API more.