Tagged #security

October 26

1 update

GitHub · Facepunch/garrysmod-requests · Update

16:05 UTC

Request: Player:RunConsoleCommand

Added in commit 09a162 and the request was closed as completed: Player:RunConsoleCommand is serverside only, has the same limitations as the global RunConsoleCommand, and some Sandbox tools already use it. The same commit adds lua_refresh_file autocomplete (#3428) and fixes the blurry citizen_sheet_bloody.vtf texture (garrysmod-issues #7116).

October 21

1 story

GitHub · Facepunch/garrysmod-requests

21:21 UTC

Request: Player:RunConsoleCommand

Astralcircle proposed Player:RunConsoleCommand, since Player:ConCommand is unsafe due to command injection.

October 19

1 story

GitHub · wiremod/wire

20:44 UTC

Wiremod drops Player:ConCommand to stop command injection

Astralcircle's merged Wiremod PR replaces Player:ConCommand with WireLib.SetConvar everywhere except E2's concmd().

Details

Shortly before, in #developer-talk, Redox showed that tools passing strings to ConCommand let players inject console commands, with Wiremod's textscreen as an example, and called it "exploit week".

October 7

1 story

Commits · garrysmod.main

19:20 UTC

Envmap and lightprobe commands blocked from Lua; dupes/saves/demos with a single tag load again

Commit 7be067 on main blocks the envmap and lightprobe commands from Lua, fixes some dupes, saves and demos not loading, and adds more decompression self checks.

Details

Block envmap and lightprobe commands from Lua
Replace usages of string.Explode with string.Split
Properly fix env_microphone missing closed captions
Dedicated server workshop cleanup now runs in the correct folder (it was cleaning cache/workshop/ while files were saved to cache/srcds/)
Fixed some dupes/saves/demos not loading when they only have a single tag (Dupe, Save or Demo)
More decompression self checks; the FastLZ fallback was removed from util.Decompress (workshop dupes/saves already use LZMA, util.Compress has used LZMA since 2014)