Elytrium / Elytrium/LimboAuth

[BUG] Players can log in without a password when the connection to the database fails

Open
#110 2 comments 3 reactions 0 assignees View on GitHub
bug
Dominant language
Java
Stars
238
Forks
125
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**
Players can log in without a password when the connection to the database fails

**To Reproduce**
Steps to reproduce the behavior:
1. Set database type to mysql
2. Set invalid user and passoword

**Expected behavior**
Players must not be allowed to join. This is a huge security consern

**Server Info (please complete the following information):**
Everything latest, downloaded today (15.07.2023)

**Additional context**

```
[15:33:19 ERROR]: Couldn't pass ProxyInitializeEvent to limboauth
net.elytrium.commons.utils.reflection.ReflectionException: An unexpected internal error was caught during the reflection operations.
at net.elytrium.limboauth.LimboAuth.reload(LimboAuth.java:310) ~[?:?]
at net.elytrium.limboauth.LimboAuth.onProxyInitialization(LimboAuth.java:208) ~[?:?]
at net.elytrium.limboauth.Lmbda$6.execute(Unknown Source) ~[?:?]
at com.velocitypowered.proxy.event.UntargetedEventHandler$VoidHandler.lambda$buildHandler$0(UntargetedEventHandler.java:56) ~[velocity-3.2.0-SNAPSHOT-260.jar:3.2.0-SNAPSHOT (git-37fedf50-b260)]
at com.velocitypowered.proxy.event.VelocityEventManager.fire(VelocityEventManager.java:597) ~[velocity-3.2.0-SNAPSHOT-260.jar:3.2.0-SNAPSHOT (git-37fedf50-b260)]
at com.velocitypowered.proxy.event.VelocityEventManager.lambda$fire$5(VelocityEventManager.java:478) ~[velocity-3.2.0-SNAPSHOT-260.jar:3.2.0-SNAPSHOT (git-37fedf50-b260)]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136) ~[?:?]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635) ~[?:?]
at java.lang.Thread.run(Thread.java:833) [?:?]
Caused by: java.lang.reflect.InvocationTargetException
at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:?]
at jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77) ~[?:?]
at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:?]
at java.lang.reflect.Method.invoke(Method.java:568) ~[?:?]
at net.elytrium.limboauth.dependencies.DatabaseLibrary.fromDriver(DatabaseLibrary.java:156) ~[?:?]
at net.elytrium.limboauth.dependencies.DatabaseLibrary.lambda$static$4(DatabaseLibrary.java:71) ~[?:?]
at net.elytrium.limboauth.dependencies.DatabaseLibrary.connect(DatabaseLibrary.java:115) ~[?:?]
at net.elytrium.limboauth.dependencies.DatabaseLibrary.connectToORM(DatabaseLibrary.java:131) ~[?:?]
at net.elytrium.limboauth.LimboAuth.reload(LimboAuth.java:302) ~[?:?]
... 8 more
Caused by: java.sql.SQLNonTransientConnectionException: Could not create connection to database server. Attempted reconnect 3 times. Giving up.
at com.mysql.cj.jdbc.exceptions.SQLError.createSQLException(SQLError.java:111) ~[?:?]
at com.mysql.cj.jdbc.exceptions.SQLError.createSQLException(SQLError.java:98) ~[?:?]
at com.mysql.cj.jdbc.exceptions.SQLError.createSQLException(SQLError.java:90) ~[?:?]
at com.mysql.cj.jdbc.exceptions.SQLError.createSQLException(SQLError.java:64) ~[?:?]
at com.mysql.cj.jdbc.exceptions.SQLError.createSQLException(SQLError.java:74) ~[?:?]
at com.mysql.cj.jdbc.ConnectionImpl.connectWithRetries(ConnectionImpl.java:895) ~[?:?]
at com.mysql.cj.jdbc.ConnectionImpl.createNewIO(ConnectionImpl.java:820) ~[?:?]
at com.mysql.cj.jdbc.ConnectionImpl.(ConnectionImpl.java:446) ~[?:?]
at com.mysql.cj.jdbc.ConnectionImpl.getInstance(ConnectionImpl.java:239) ~[?:?]
at com.mysql.cj.jdbc.NonRegisteringDriver.connect(NonRegisteringDriver.java:188) ~[?:?]
at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:?]
at jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77) ~[?:?]
at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:?]
at java.lang.reflect.Method.invoke(Method.java:568) ~[?:?]
at net.elytrium.limboauth.dependencies.DatabaseLibrary.fromDriver(DatabaseLibrary.java:156) ~[?:?]
at net.elytrium.limboauth.dependencies.DatabaseLibrary.lambda$static$4(DatabaseLibrary.java:71) ~[?:?]
at net.elytrium.limboauth.dependencies.DatabaseLibrary.connect(DatabaseLibrary.java:115) ~[?:?]
at net.elytrium.limboauth.dependencies.DatabaseLibrary.connectToORM(DatabaseLibrary.java:131) ~[?:?]
at net.elytrium.limboauth.LimboAuth.reload(LimboAuth.java:302) ~[?:?]
... 8 more
Caused by: com.mysql.cj.exceptions.CJCommunicationsException: Communications link failure

The last packet sent successfully to the server was 0 milliseconds ago. The driver has not received any packets from the server.
at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) ~[?:?]
at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:77) ~[?:?]
at jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) ~[?:?]
at java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:499) ~[?:?]
at java.lang.reflect.Constructor.newInstance(Constructor.java:480) ~[?:?]
at com.mysql.cj.exceptions.ExceptionFactory.createException(ExceptionFactory.java:62) ~[?:?]
at com.mysql.cj.exceptions.ExceptionFactory.createException(ExceptionFactory.java:105) ~[?:?]
at com.mysql.cj.exceptions.ExceptionFactory.createException(ExceptionFactory.java:150) ~[?:?]
at com.mysql.cj.exceptions.ExceptionFactory.createCommunicationsException(ExceptionFactory.java:166) ~[?:?]
at com.mysql.cj.protocol.a.NativeSocketConnection.connect(NativeSocketConnection.java:89) ~[?:?]
at com.mysql.cj.NativeSession.connect(NativeSession.java:121) ~[?:?]
at com.mysql.cj.jdbc.ConnectionImpl.connectWithRetries(ConnectionImpl.java:839) ~[?:?]
at com.mysql.cj.jdbc.ConnectionImpl.createNewIO(ConnectionImpl.java:820) ~[?:?]
at com.mysql.cj.jdbc.ConnectionImpl.(ConnectionImpl.java:446) ~[?:?]
at com.mysql.cj.jdbc.ConnectionImpl.getInstance(ConnectionImpl.java:239) ~[?:?]
at com.mysql.cj.jdbc.NonRegisteringDriver.connect(NonRegisteringDriver.java:188) ~[?:?]
at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:?]
at jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77) ~[?:?]
at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:?]
at java.lang.reflect.Method.invoke(Method.java:568) ~[?:?]
at net.elytrium.limboauth.dependencies.DatabaseLibrary.fromDriver(DatabaseLibrary.java:156) ~[?:?]
at net.elytrium.limboauth.dependencies.DatabaseLibrary.lambda$static$4(DatabaseLibrary.java:71) ~[?:?]
at net.elytrium.limboauth.dependencies.DatabaseLibrary.connect(DatabaseLibrary.java:115) ~[?:?]
at net.elytrium.limboauth.dependencies.DatabaseLibrary.connectToORM(DatabaseLibrary.java:131) ~[?:?]
at net.elytrium.limboauth.LimboAuth.reload(LimboAuth.java:302) ~[?:?]
... 8 more
Caused by: java.net.ConnectException: Connection refused
at sun.nio.ch.Net.connect0(Native Method) ~[?:?]
at sun.nio.ch.Net.connect(Net.java:579) ~[?:?]
at sun.nio.ch.Net.connect(Net.java:568) ~[?:?]
at sun.nio.ch.NioSocketImpl.connect(NioSocketImpl.java:588) ~[?:?]
at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:327) ~[?:?]
at java.net.Socket.connect(Socket.java:633) ~[?:?]
at com.mysql.cj.protocol.StandardSocketFactory.connect(StandardSocketFactory.java:153) ~[?:?]
at com.mysql.cj.protocol.a.NativeSocketConnection.connect(NativeSocketConnection.java:63) ~[?:?]
at com.mysql.cj.NativeSession.connect(NativeSession.java:121) ~[?:?]
at com.mysql.cj.jdbc.ConnectionImpl.connectWithRetries(ConnectionImpl.java:839) ~[?:?]
at com.mysql.cj.jdbc.ConnectionImpl.createNewIO(ConnectionImpl.java:820) ~[?:?]
at com.mysql.cj.jdbc.ConnectionImpl.(ConnectionImpl.java:446) ~[?:?]
at com.mysql.cj.jdbc.ConnectionImpl.getInstance(ConnectionImpl.java:239) ~[?:?]
at com.mysql.cj.jdbc.NonRegisteringDriver.connect(NonRegisteringDriver.java:188) ~[?:?]
at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:?]
at jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77) ~[?:?]
at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:?]
at java.lang.reflect.Method.invoke(Method.java:568) ~[?:?]
at net.elytrium.limboauth.dependencies.DatabaseLibrary.fromDriver(DatabaseLibrary.java:156) ~[?:?]
at net.elytrium.limboauth.dependencies.DatabaseLibrary.lambda$static$4(DatabaseLibrary.java:71) ~[?:?]
at net.elytrium.limboauth.dependencies.DatabaseLibrary.connect(DatabaseLibrary.java:115) ~[?:?]
at net.elytrium.limboauth.dependencies.DatabaseLibrary.connectToORM(DatabaseLibrary.java:131) ~[?:?]
at net.elytrium.limboauth.LimboAuth.reload(LimboAuth.java:302) ~[?:?]
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Reproduce the failure with MySQL and invalid credentials, then start with LimboAuth.java around lines 208, 302, and 310. Trace the database error through DatabaseLibrary.java at lines 71, 115, 131, and 156 and into the login behavior. Done means players cannot join when the database connection fails, with coverage for this failure path.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, mysql
Domain
authentication, database, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.