fix(multiplayer): enforce assignment opaque ids

This commit is contained in:
Josh Creek
2026-09-01 22:40:43 +01:00
parent dac414274e
commit 2bdf876b47
5 changed files with 23 additions and 5 deletions
+1 -1
View File
@@ -493,7 +493,7 @@ static func _valid_websocket_event(event: Dictionary) -> bool:
return false
var event_name := String(event["event"])
if event_name == "assignment_changed":
return event.has("match_id") and event["match_id"] is String and not String(event["match_id"]).is_empty() and event.has("server_id") and event["server_id"] is String and not String(event["server_id"]).is_empty()
return event.has("match_id") and event["match_id"] is String and is_valid_resource_id(String(event["match_id"])) and event.has("server_id") and event["server_id"] is String and is_valid_resource_id(String(event["server_id"]))
if event_name == "error":
return event.has("code") and String(event["code"]) in ["REVISION_GAP", "NOT_AUTHORISED", "INVALID_STATE", "RATE_LIMITED"]
if event_name == "state_changed":