CommonClient: Prevent disconnect from being sent bad DeathLink data - #6376
Conversation
|
So.. this is an interesting problem. By no longer crashing and silently ignoring the issue even more custom clients will construct a wrong deathlink package in the future. On the other hand, leaving it as is does allow a malicous actor to snipe commonclients and force them to disconnect. |
|
In fairness, nobody else dying when you do would give that away. Clients don't get told who sent it either, so there's not much they can do other than ignore it. It'd need to be a server enforced thing and I figure there's reasons not to want to do it there. Fwiw this covers the common mistakes, malicious actors have better ways of crashing CommonClient already. |
silasary
left a comment
There was a problem hiding this comment.
I'm content to say that "Nobody else is dying when I send a DL" is enough of a sign that the client is doing something wrong.
What is this fixing or adding?
Some clients send incorrectly made DeathLink packets, usually by forgetting to add the timestamp.
This prevents CommonClient from disconnecting when trying to handle missing
dataortimefields in a DeathLink packet sent by a another client. Bad packets are ignored.This doesn't do type checking of fields, but I'd argue that shouldn't really happen outside of a malicious client. Feel free to add that as well.
How was this tested?
Connect a deathlink game, open another websocket and deliberately send the packets described in the linked issue.
Closes #6375