jcreek/CosmicClash
1
0
Fork 0
mirror of https://github.com/jcreek/CosmicClash.git synced 2026-09-10 16:04:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(multiplayer): validate REST response ids

Browse Source
This commit is contained in:
Josh Creek
2026-09-01 22:47:57 +01:00
parent bda3fc5aff
commit edd78d2548
3 changed files with 31 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Game/scripts/control_plane_client.gd
+17 -3
View File
@@ -429,7 +429,7 @@ func _on_request_completed(result: HTTPRequest.Result, response_code: int, _head
if operation == "steam_session":
var returned_token := String(payload.get("access_token", ""))
var returned_player_id := String(payload.get("player_id", ""))
if returned_player_id.is_empty() or not is_valid_access_token(returned_token):
if not is_valid_resource_id(returned_player_id) or not is_valid_access_token(returned_token):
request_failed.emit(operation, response_code, "invalid session response")
return
player_id = returned_player_id
@@ -438,8 +438,18 @@ func _on_request_completed(result: HTTPRequest.Result, response_code: int, _head
session_expires_at = String(payload.get("expires_at", ""))
connect_event_stream()
session_changed.emit(player_id)
elif operation == "queue_create":
state.begin_queue(String(payload.get("ticket_id", "")), String(payload.get("playlist", "")))
elif operation == "queue_create" or operation == "queue_recover" or operation == "queue_heartbeat" or operation == "queue_cancel":
if not _valid_response_opaque_id(payload, "ticket_id"):
state.fail("Queue response contains an invalid ticket identifier")
request_failed.emit(operation, response_code, "invalid ticket identifier")
return
if operation == "queue_create":
state.begin_queue(String(payload["ticket_id"]), String(payload.get("playlist", "")))
elif operation.begins_with("proposal_"):
if not _valid_response_opaque_id(payload, "proposal_id"):
state.fail("Proposal response contains an invalid proposal identifier")
request_failed.emit(operation, response_code, "invalid proposal identifier")
return
if operation.begins_with("queue_"):
state.apply_ticket_update(normalize_ticket(payload))
elif operation.begins_with("proposal_"):
@@ -511,6 +521,10 @@ static func _valid_revision(value: Variant) -> bool:
return false
static func _valid_response_opaque_id(payload: Dictionary, key: String) -> bool:
return payload.has(key) and payload[key] is String and is_valid_resource_id(String(payload[key]))
func _on_resync_required(resource_id: String) -> void:
if not _operation.is_empty():
_pending_resync_resource_id = resource_id