mirror of
https://github.com/Cockatrice/Cockatrice.git
synced 2026-09-21 17:15:09 -07:00
1018c93d06
- TCP client connections: reject messages whose declared length is negative or exceeds a 1.5MB cap immediately instead of buffering indefinitely, preventing unbounded memory growth and the previously stuck state caused by negative lengths overflowing the int header. - ISL connections: apply the same length validation with a 4MB cap, disconnecting the peer on an implausible length. - Websockets: only trust the forwarded client-address header (e.g. X-Forwarded-For) when the websocket connection originates from an address in security/trusted_sources. Previously any client could spoof its address to bypass bans, user limits and rate limiting. Took 3 minutes |
||
|---|---|---|
| .. | ||
| docker | ||
| migrations | ||
| mysql-storage | ||
| resources | ||
| scripts | ||
| src | ||
| check_schema_version.sh | ||
| CMakeLists.txt | ||
| servatrice.desktop | ||
| servatrice.ini.example | ||
| servatrice.qrc | ||
| servatrice.rc | ||
| servatrice.sql | ||