Security fix: ability to open any inventory #53
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Current ox_inventory version (v2.44.6) has a vulnerability where users can open any inventory bypassing all security checks.
This is due to there not being any validation made on the
invTypeparameter within the openInventory function & callback.As discussed with Linden ideal solution to allow customization with relative ease without needing to add inventory types to a separate registry, before opening another inventory check that the requested invType is equal to the inventory type. This will lead to false positives, but is only applicable to poorly created integrations where developers aren't paying attention to what they're passing as arguments.
Being that most occurrences of this would be due to people trying to exploit it, I kept the nice DropPlayer in there, can switch it to a warn log via ox_lib if judged to harsh or alter the reasons.
This can be replicated by adding the following code to demonstrate the lack of injection protection of fxserver by overriding the closeInventory function (preventing the inventory from closing due to failed security checks) and passing invalid arguments to the server to open any inventory.