[Tutorial] Protection against '%' dialog vulnerability!
#1

Example:

https://www.youtube.com/watch?v=RJ6F17EFqYc

You can fix it simple by checking the inputtext before using it with this stock :

pawn Code:
stock CheckDialogBug(message[])
{
    new message_length = strlen(message);
    for(new i; i < message_length; i++)
    {
        if(message[i] == '%')
        {
            return 1;
        }
    }
    return 0;
}
Now you're gonna use this checking in all DIALOG_STYLE_INPUT dialogs.

Example of usage:

Code:
if(CheckDialogBug(inputtext)) return SendClientMessage(playerid, 0, "{FFFFFF}You can't use '%' in strings.");
Reply
#2

I doubt if this is a bug... How do you use the inputtext in your format's and printfs?

Because if i use a %s in any format/printf, then it just works.
My test code:
PHP Code:
public OnGameModeInit() {
    new
        
message[] = "%s",
        
string[128]
    ;
    
format(stringsizeof(string), "%s"message);
    
    
printf("%s"message);
    return 
1;

UPDATE: nvm, i see now that SendClientMessageToAll doesn't like %s and any other format.
Reply
#3

Metharon is right, it's a bug. (with entering a %s and using it on format, it will fuck the server)
There's a filter on message with OnPlayerText and OnPlayerCommandText, it removes % on input and also colors on input too!
But you can use the filter which is using on OnPlayerText and OnPlayerCommandText:
Code:
for(new i = 0, j = strlen(input); i < j; i++)
{
	if(input[i] == '%') input[i] = '#';
}
Also you must write a code to filter color embedding like {FFFFFF} (isn't a vulnerability but player mustn't be able to use embedded colors IMO)
Easy to write, I'll post it here soon.
Reply
#4

Ok, here is the code:

Code:
// By AliAssassiN
// Code removed- sorry
Example:
Code:
new test[90];
format(test, 90, "Gitchasbdhias {dsadaksm}{{FFFFFF}} {FF00AA0} {FF00AA} ASLdM {ASdSAMk2} {ZAFFAA}QDad");
printf("Before: %s\n", test);
removeEmbeddedColor(test);
printf("After: %s\n", test);
Output:
Code:
Before: Gitchasbdhias {dsadaksm}{{FFFFFF}} {FF00AA0} {FF00AA} ASLdM {ASdSAMk2} {ZAFFAA}QDad

After: Gitchasbdhias {dsadaksm}{ FFFFFF } {FF00AA0}  FF00AA  ASLdM {ASdSAMk2} {ZAFFAA}QDad
Reply


Forum Jump:


Users browsing this thread: 1 Guest(s)