jcreek/CosmicClash
1
0
Fork 0
mirror of https://github.com/jcreek/CosmicClash.git synced 2026-09-11 19:53:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(multiplayer): enforce opaque event resource ids

Browse Source
This commit is contained in:
Josh Creek
2026-09-01 22:22:34 +01:00
parent 87d43302e1
commit 17e6a9bc20
3 changed files with 18 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
multiplayer-next.md
+2
View File
@@ -1562,3 +1562,5 @@ Client sessions now fail closed at the expiry boundary and proactively clear cre
Queue heartbeat and cancellation revision conflicts now schedule the same authoritative ticket recovery as proposal conflicts, preventing stale client actions from leaving the visible queue state unresolved. Adversarial operation/status/identity coverage is included.
WebSocket event envelopes now require RFC3339 timestamps rather than merely non-empty text, matching the versioned contract; session-expiry format checks use the same boundary validator. Malformed-format adversarial coverage is included.
WebSocket event resource identifiers now enforce the contract’s opaque 16–128 character allowlist, preventing path/separator text or undersized identifiers from entering the client projection.