[BUG] Players can log in without a password when the connection to the database fails
- Dominant language
- Java
- Stars
- 238
- Forks
- 125
- PR merge metrics
- No merged PRs in 30d
Description
**Describe the bug**
Players can log in without a password when the connection to the database fails
**To Reproduce**
Steps to reproduce the behavior:
1. Set database type to mysql
2. Set invalid user and passoword
**Expected behavior**
Players must not be allowed to join. This is a huge security consern
**Server Info (please complete the following information):**
Everything latest, downloaded today (15.07.2023)
**Additional context**
```
[15:33:19 ERROR]: Couldn't pass ProxyInitializeEvent to limboauth
net.elytrium.commons.utils.reflection.ReflectionException: An unexpected internal error was caught during the reflection operations.
at net.elytrium.limboauth.LimboAuth.reload(LimboAuth.java:310) ~[?:?]
at net.elytrium.limboauth.LimboAuth.onProxyInitialization(LimboAuth.java:208) ~[?:?]
at net.elytrium.limboauth.Lmbda$6.execute(Unknown Source) ~[?:?]
at com.velocitypowered.proxy.event.UntargetedEventHandler$VoidHandler.lambda$buildHandler$0(UntargetedEventHandler.java:56) ~[velocity-3.2.0-SNAPSHOT-260.jar:3.2.0-SNAPSHOT (git-37fedf50-b260)]
at com.velocitypowered.proxy.event.VelocityEventManager.fire(VelocityEventManager.java:597) ~[velocity-3.2.0-SNAPSHOT-260.jar:3.2.0-SNAPSHOT (git-37fedf50-b260)]
at com.velocitypowered.proxy.event.VelocityEventManager.lambda$fire$5(VelocityEventManager.java:478) ~[velocity-3.2.0-SNAPSHOT-260.jar:3.2.0-SNAPSHOT (git-37fedf50-b260)]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136) ~[?:?]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635) ~[?:?]
at java.lang.Thread.run(Thread.java:833) [?:?]
Caused by: java.lang.reflect.InvocationTargetException
at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:?]
at jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77) ~[?:?]
at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:?]
at java.lang.reflect.Method.invoke(Method.java:568) ~[?:?]
at net.elytrium.limboauth.dependencies.DatabaseLibrary.fromDriver(DatabaseLibrary.java:156) ~[?:?]
at net.elytrium.limboauth.dependencies.DatabaseLibrary.lambda$static$4(DatabaseLibrary.java:71) ~[?:?]
at net.elytrium.limboauth.dependencies.DatabaseLibrary.connect(DatabaseLibrary.java:115) ~[?:?]
at net.elytrium.limboauth.dependencies.DatabaseLibrary.connectToORM(DatabaseLibrary.java:131) ~[?:?]
at net.elytrium.limboauth.LimboAuth.reload(LimboAuth.java:302) ~[?:?]
... 8 more
Caused by: java.sql.SQLNonTransientConnectionException: Could not create connection to database server. Attempted reconnect 3 times. Giving up.
at com.mysql.cj.jdbc.exceptions.SQLError.createSQLException(SQLError.java:111) ~[?:?]
at com.mysql.cj.jdbc.exceptions.SQLError.createSQLException(SQLError.java:98) ~[?:?]
at com.mysql.cj.jdbc.exceptions.SQLError.createSQLException(SQLError.java:90) ~[?:?]
at com.mysql.cj.jdbc.exceptions.SQLError.createSQLException(SQLError.java:64) ~[?:?]
at com.mysql.cj.jdbc.exceptions.SQLError.createSQLException(SQLError.java:74) ~[?:?]
at com.mysql.cj.jdbc.ConnectionImpl.connectWithRetries(ConnectionImpl.java:895) ~[?:?]
at com.mysql.cj.jdbc.ConnectionImpl.createNewIO(ConnectionImpl.java:820) ~[?:?]
at com.mysql.cj.jdbc.ConnectionImpl.(ConnectionImpl.java:446) ~[?:?]
at com.mysql.cj.jdbc.ConnectionImpl.getInstance(ConnectionImpl.java:239) ~[?:?]
at com.mysql.cj.jdbc.NonRegisteringDriver.connect(NonRegisteringDriver.java:188) ~[?:?]
at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:?]
at jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77) ~[?:?]
at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:?]
at java.lang.reflect.Method.invoke(Method.java:568) ~[?:?]
at net.elytrium.limboauth.dependencies.DatabaseLibrary.fromDriver(DatabaseLibrary.java:156) ~[?:?]
at net.elytrium.limboauth.dependencies.DatabaseLibrary.lambda$static$4(DatabaseLibrary.java:71) ~[?:?]
at net.elytrium.limboauth.dependencies.DatabaseLibrary.connect(DatabaseLibrary.java:115) ~[?:?]
at net.elytrium.limboauth.dependencies.DatabaseLibrary.connectToORM(DatabaseLibrary.java:131) ~[?:?]
at net.elytrium.limboauth.LimboAuth.reload(LimboAuth.java:302) ~[?:?]
... 8 more
Caused by: com.mysql.cj.exceptions.CJCommunicationsException: Communications link failure
The last packet sent successfully to the server was 0 milliseconds ago. The driver has not received any packets from the server.
at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) ~[?:?]
at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:77) ~[?:?]
at jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) ~[?:?]
at java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:499) ~[?:?]
at java.lang.reflect.Constructor.newInstance(Constructor.java:480) ~[?:?]
at com.mysql.cj.exceptions.ExceptionFactory.createException(ExceptionFactory.java:62) ~[?:?]
at com.mysql.cj.exceptions.ExceptionFactory.createException(ExceptionFactory.java:105) ~[?:?]
at com.mysql.cj.exceptions.ExceptionFactory.createException(ExceptionFactory.java:150) ~[?:?]
at com.mysql.cj.exceptions.ExceptionFactory.createCommunicationsException(ExceptionFactory.java:166) ~[?:?]
at com.mysql.cj.protocol.a.NativeSocketConnection.connect(NativeSocketConnection.java:89) ~[?:?]
at com.mysql.cj.NativeSession.connect(NativeSession.java:121) ~[?:?]
at com.mysql.cj.jdbc.ConnectionImpl.connectWithRetries(ConnectionImpl.java:839) ~[?:?]
at com.mysql.cj.jdbc.ConnectionImpl.createNewIO(ConnectionImpl.java:820) ~[?:?]
at com.mysql.cj.jdbc.ConnectionImpl.(ConnectionImpl.java:446) ~[?:?]
at com.mysql.cj.jdbc.ConnectionImpl.getInstance(ConnectionImpl.java:239) ~[?:?]
at com.mysql.cj.jdbc.NonRegisteringDriver.connect(NonRegisteringDriver.java:188) ~[?:?]
at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:?]
at jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77) ~[?:?]
at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:?]
at java.lang.reflect.Method.invoke(Method.java:568) ~[?:?]
at net.elytrium.limboauth.dependencies.DatabaseLibrary.fromDriver(DatabaseLibrary.java:156) ~[?:?]
at net.elytrium.limboauth.dependencies.DatabaseLibrary.lambda$static$4(DatabaseLibrary.java:71) ~[?:?]
at net.elytrium.limboauth.dependencies.DatabaseLibrary.connect(DatabaseLibrary.java:115) ~[?:?]
at net.elytrium.limboauth.dependencies.DatabaseLibrary.connectToORM(DatabaseLibrary.java:131) ~[?:?]
at net.elytrium.limboauth.LimboAuth.reload(LimboAuth.java:302) ~[?:?]
... 8 more
Caused by: java.net.ConnectException: Connection refused
at sun.nio.ch.Net.connect0(Native Method) ~[?:?]
at sun.nio.ch.Net.connect(Net.java:579) ~[?:?]
at sun.nio.ch.Net.connect(Net.java:568) ~[?:?]
at sun.nio.ch.NioSocketImpl.connect(NioSocketImpl.java:588) ~[?:?]
at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:327) ~[?:?]
at java.net.Socket.connect(Socket.java:633) ~[?:?]
at com.mysql.cj.protocol.StandardSocketFactory.connect(StandardSocketFactory.java:153) ~[?:?]
at com.mysql.cj.protocol.a.NativeSocketConnection.connect(NativeSocketConnection.java:63) ~[?:?]
at com.mysql.cj.NativeSession.connect(NativeSession.java:121) ~[?:?]
at com.mysql.cj.jdbc.ConnectionImpl.connectWithRetries(ConnectionImpl.java:839) ~[?:?]
at com.mysql.cj.jdbc.ConnectionImpl.createNewIO(ConnectionImpl.java:820) ~[?:?]
at com.mysql.cj.jdbc.ConnectionImpl.(ConnectionImpl.java:446) ~[?:?]
at com.mysql.cj.jdbc.ConnectionImpl.getInstance(ConnectionImpl.java:239) ~[?:?]
at com.mysql.cj.jdbc.NonRegisteringDriver.connect(NonRegisteringDriver.java:188) ~[?:?]
at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:?]
at jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77) ~[?:?]
at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:?]
at java.lang.reflect.Method.invoke(Method.java:568) ~[?:?]
at net.elytrium.limboauth.dependencies.DatabaseLibrary.fromDriver(DatabaseLibrary.java:156) ~[?:?]
at net.elytrium.limboauth.dependencies.DatabaseLibrary.lambda$static$4(DatabaseLibrary.java:71) ~[?:?]
at net.elytrium.limboauth.dependencies.DatabaseLibrary.connect(DatabaseLibrary.java:115) ~[?:?]
at net.elytrium.limboauth.dependencies.DatabaseLibrary.connectToORM(DatabaseLibrary.java:131) ~[?:?]
at net.elytrium.limboauth.LimboAuth.reload(LimboAuth.java:302) ~[?:?]
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Reproduce the failure with MySQL and invalid credentials, then start with LimboAuth.java around lines 208, 302, and 310. Trace the database error through DatabaseLibrary.java at lines 71, 115, 131, and 156 and into the login behavior. Done means players cannot join when the database connection fails, with coverage for this failure path.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, mysql
- Domain
- authentication, database, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100