Apparently cheat clients have figured out that none of SS14's code does validation against NaN inputs. Uh oh.
IRobustSerializer can now be configured to remove NaN values when reading. This is intended to be set on the server to completely block the issue.
Added "Unsafe" float types that can be used to bypass the new configurable behavior, in case somebody *really* needs NaNs.
An alternative option was to make a "SafeFloat" type, and only apply the sanitization to that. The problem is that would require updating hundreds if not thousands of messages in SS14, and probably significantly confuse contributors on "when use what." Blocking NaNs by default is likely to cause little issues while ensuring the entire exploit is guaranteed impossible.
* WebSocket-based data transfer system
* Move resource downloads/uploads to the new transfer system
Should drastically increase the permitted practical size
* Transfer impl for Lidgren
* Async impl for receive stream
* Use unbounded channel for Lidgren
* Add metrics
* More comments
* Add serverside stream limit to avoid being a DoS vector
* Fix tests
* Oops forgot to actually implement sequence channels in NetMessage
* Doc comment for NetMessage.SequenceChannel
* Release notes
* Add ValidateMemberAttribute, analyzer and test
* Use attribute on DirtyFields methods
* Defer member lookup
* Additional test case
* Add support for collection types
* Poke tests
* Revert "Add support for collection types"
This reverts commit 2b8f5534bd.
* break, not continue
* Cheaper attribute check with AttributeHelper
* Clean up unused helper method
---------
Co-authored-by: PJB3005 <pieterjan.briers+git@gmail.com>
* Add Prototype analyzer
* Add Prototype fixer
* Early return after finding prototype attribute
* Add PrototypeEndsWithPrototypeRule diagnostic
* Oops. Uncomment parallelizable.
* Rework to ignore redundancy for non-literal string values
* Allow redundancy when removal would expose class name not ending in "Prototype"
* Promote PrototypeEndsWithPrototypeRule from warning to error, since it causes a runtime error.
* No need to get the symbol to get the class identifier
* Minor cleanup
* A little more cleanup
* More specific location for redundant name
* Refactor redundant name fixer so argument order is no longer important
* Add failing test
* Use symbol analysis to fix alias handling
* Oops! We have to go back to the previous syntax-based approach.
Now it's a hybrid.
Also fixed tests to not copy the prototype definitions.
---------
Co-authored-by: PJB3005 <pieterjan.briers+git@gmail.com>
It apparently broke clean builds, as the dependencies aren't in the project asset list or something anymore. I tried to fix this, but it seems impossible to do without relying on .NET SDK internals, as there's no point in the NuGet graph walk process that seems cleanly extensible.
Instead let's just do the much dumber thing: a bunch of .props files for content to import. Hooray!
This also means that I have to go through and *explicitly* disable transitive dependencies everywhere in RT. This thankfully isn't too hard.
* make EntityQuery.Resolve error not useless
* it actually wasnt that bad
* goida
* make EntityQuery constructor internal
---------
Co-authored-by: deltanedas <@deltanedas:kde.org>
Robust.UnitTesting was both ALL tests for RT, and also API surface for content tests.
Tests are now split into separate projects as appropriate, and the API side has also been split off.
This is basically a lightweight marker type saying "this string contains markup". Intended to avoid injection accidents if people don't realize they should escape stuff.
From my extremely rough and unscientific tests, this saves like 15 MB of client memory on the main menu. Probably also just improves load speed on startup too.
It's per file to keep the implementation simple.
Tayrtahn