Patch command injection from entity inputs
Open
Nobody has claimed this yet.
game bugfix
- Dominant language
- C++
- Stars
- 122
- Forks
- 45
- PR merge metrics
- No merged PRs in 30d
Description
A malicious map could potentially execute arbitrary commands as the player, such as unbindall and other such shenanigans. This has been somewhat addressed by ReloadedFix, but more commands should be blacklisted / swap to a whitelist / another solution, and it should apply universally.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the command execution from a malicious map or entity input and review how ReloadedFix currently addresses it. Compare blacklist, whitelist, and other mitigation options, then verify that the chosen protection applies universally and blocks commands such as unbindall.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- game-dev, security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100