Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

was not safe for net #2220

Closed
imsnaily opened this issue Sep 26, 2023 · 2 comments
Closed

was not safe for net #2220

imsnaily opened this issue Sep 26, 2023 · 2 comments

Comments

@imsnaily
Copy link

imsnaily commented Sep 26, 2023

So basically you can crash a server spamming TriggerServerEvent of the server events as playerDropped, playerJoining, explosionEvent, etc...

If there's a good amount of resources that handles that events the server will just crash. It could be a nice thing to like "whitelist" this events and prevent from using them on TriggerServerEvent

image

@tens0rfl0w
Copy link
Contributor

tens0rfl0w commented Sep 27, 2023

I'm curious if you actually managed to "crash" a server with this method, as testing this on a loaded server had no impact at all. (If you did, you could provide your crash dump.)

Dropping this event client-side wouldn't make much sense as someone who would abuse this would already be able to execute arbitrary code. (Also the event handlers like playerDropped can be registered as network events per script, so blocking this could result in broken scripts, though usage is unlikely due to the prints 'monitor' and other stock resources produce.)

Blocking those certain base events would still leave all other custom events open for this kind of approach. (Server frameworks have a lot of those generic event handlers.)

Still curious if you managed to "crash" a server with this, as the dropping of such events should be lightweight.
For reference the lua implementation just drops the packet and doesn't process it at all (per script):

if not eventHandlerEntry.safeForNet then
Citizen.Trace('event ' .. eventName .. " was not safe for net\n")
_G.source = lastSource
return
end

@Zydson
Copy link

Zydson commented Sep 27, 2023

It won't crash, only will heavily load on CPU, also seems like you are running localhost so you don't get kicked for network event overflow. Normally you could not spam events every 0ms without getting kicked.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants