jcreek/CosmicClash
1
0
Fork 0
mirror of https://github.com/jcreek/CosmicClash.git synced 2026-09-13 05:12:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(multiplayer): validate server event resource ids

Browse Source
This commit is contained in:
Josh Creek
2026-09-01 22:25:04 +01:00
parent fd1a4d9577
commit 429fb87c08
4 changed files with 14 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
multiplayer-next.md
+2
View File
@@ -1565,4 +1565,6 @@ WebSocket event envelopes now require RFC3339 timestamps rather than merely non-
WebSocket event resource identifiers now enforce the contract’s opaque 16–128 character allowlist, preventing path/separator text or undersized identifiers from entering the client projection.
The Go event hub now enforces the same resource-ID allowlist before publication, so malformed identifiers are rejected at the server boundary rather than only discarded by clients.
The matchmaking UI now displays the authoritative proposal countdown from the server expiry epoch, clamped at zero and retaining compatible copy when older responses omit expiry metadata. Adversarial countdown tests cover delayed and missing-expiry responses.