mirror of
https://github.com/openfrontio/OpenFrontIO.git
synced 2026-06-21 07:50:45 +00:00
fix(game): patch Desync DoS vulnerability with strict majority consensus (#3956)
Resolves #3959 ## Description: This PR fixes a Denial of Service (DoS) vulnerability in 1v1 matches related to desync reporting. The `findOutOfSyncClients` logic previously forced a game-ending desync if half or more players reported conflicting hashes (`outOfSyncClients.length >= Math.floor(this.activeClients.length / 2)`). In a 1v1, this meant a single malicious player sending a bad hash could trigger a global desync, crashing their opponent's game session. The logic has been corrected to require a **strict majority** (`> Math.floor(this.activeClients.length / 2)`) to declare a lobby-wide desync. In a 1v1 game, a single malicious actor will now simply be flagged as the out-of-sync client and disconnected, allowing the honest player to continue their session uninterrupted. ## Please complete the following: - [X] I have added screenshots for all UI updates - [X] I process any text displayed to the user through translateText() and I've added it to the en.json file - [X] I have added relevant tests to the test directory - [X] I confirm I have thoroughly tested these changes and take full responsibility for any bugs introduced ## Please put your Discord username so you can be contacted if a bug or regression is found: barfires Co-authored-by: Josh Harris <josh@wickedsick.com>
This commit is contained in:
@@ -1223,8 +1223,8 @@ export class GameServer {
|
||||
}
|
||||
}
|
||||
|
||||
// If half clients out of sync assume all are out of sync.
|
||||
if (outOfSyncClients.length >= Math.floor(this.activeClients.length / 2)) {
|
||||
// If strict majority clients out of sync assume all are out of sync.
|
||||
if (outOfSyncClients.length > Math.floor(this.activeClients.length / 2)) {
|
||||
outOfSyncClients = this.activeClients;
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user