jcreek/CosmicClash
1
0
Fork 0
mirror of https://github.com/jcreek/CosmicClash.git synced 2026-09-11 08:23:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(multiplayer): fence workload control URLs

Browse Source
This commit is contained in:
Josh Creek
2026-09-03 21:31:09 +01:00
parent 4e1dd0d24e
commit 61daf139c5
4 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Game/tests/cases/test_connection_lease_client.gd
+1
View File
@@ -19,6 +19,7 @@ func test_connection_lease_response_classification_is_fail_closed() -> void:
func test_connection_lease_configuration_and_keys_are_bound() -> void:
assert_true(LeaseClient.valid_configuration("https://control.invalid", "workload-token", "match-1234567890", "server-123456789"), "valid workload configuration is accepted")
assert_true(not LeaseClient.valid_configuration("https://control.invalid?token=leak", "workload-token", "match-1234567890", "server-123456789"), "query-bearing endpoint is rejected")
assert_true(not LeaseClient.valid_configuration("https://control@evil.invalid", "workload-token", "match-1234567890", "server-123456789"), "userinfo-bearing endpoint is rejected")
assert_true(not LeaseClient.valid_configuration("https://control.invalid", "bad\ntoken", "match-1234567890", "server-123456789"), "header injection is rejected")
var initial := LeaseClient.event_key("match-123456789", "player-12345678", "connect", 0)
assert_true(initial != LeaseClient.event_key("match-123456789", "player-12345678", "disconnect", 1), "operation and generation bind the key")
Game/tests/cases/test_server_result_client.gd
+1
View File
@@ -13,6 +13,7 @@ func test_result_nonce_is_deterministic_and_score_bound() -> void:
func test_result_configuration_fails_closed() -> void:
assert_true(Client.valid_configuration("https://control.invalid", "token", "match-123456789", "server-123456789"), "valid result reporter configuration is accepted")
assert_true(not Client.valid_configuration("https://control.invalid?token=leak", "token", "match-123456789", "server-123456789"), "query-bearing endpoint is rejected")
assert_true(not Client.valid_configuration("https://control@evil.invalid", "token", "match-123456789", "server-123456789"), "userinfo-bearing endpoint is rejected")
assert_true(not Client.valid_configuration("https://control.invalid", "", "match-123456789", "server-123456789"), "empty bearer is rejected")