Tips can be spoofed

[KradekMFC]

The script can be spoofed by someone entering a message that matches the tip regex.

[jinxya408]

Do you know how the format would go like?? Ive seen the tip regex before
but dont know what to put down
On 8 Aug 2013 11:29, "KradekMFC" notifications@github.com wrote:

The script can be spoofed by someone entering a message that matches the
tip regex.

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/1
.

[KradekMFC]

I have a fix in mind. I will be modifying the script code to tap into the message queue, in which case the script can look only for tip messages from the server rather than parsing messages out of the chat box.

I mainly just wanted to document it here so I don't forget.

[jinxya408]

Ok great thank you and i cant wait til u get it figured out..i appreciate
what u do
On 8 Aug 2013 11:43, "KradekMFC" notifications@github.com wrote:

I have a fix in mind. I will be modifying the script code to tap into the
message queue, in which case the script can look only for tip messages from
the server rather than parsing messages out of the chat box.

I mainly just wanted to document it here so I don't forget.

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/1#issuecomment-22345436
.

[BrandonBrink]

As a short term fix, I found that changing the first part of the tip regex to (.[^:]+) instead of (.*) will prevent the current tip spoofing at least.

[KradekMFC]

Thanks Wolfboss! I'll drop that in as an interim fix until I get some time to rework.

[baras]

Your solution was to check the contributor name for ":" because if it's not a real tip, the name would be followed by a colon.
This does not work if I type my name and the tip like so:
MyUserName: MyUserName has tipped TheModelName 1000 tokens.
The script will still count the fake tip.

[baras]

Okay. Real tip span classes includes "chat_system".
So I added one line at the top of function handleTip:

    function handleTip(tip, tipSpan) {
        if( tipSpan.getAttribute( 'class' ).indexOf( 'chat_system' ) === -1 ) return;
        //parse the values
        ...
    }

and it works :-)

[KradekMFC]

Thank you @ybaras . I went ahead and added your fix to the script.

There is a more sound technical fix that I have simply not had the time to add. We really shouldn't be scraping chat for the tip messages. Since December 2013, MFC has been sending tips to the client with a FCTYPE_TOKENINC message instead of a chat message. MFCAssistant should tap into the message stream looking for those messages rather than reading them from chat, which would eliminate the possibility of spoofing entirely. Doing that requires some restructuring of the code though, so I haven't bit it off.

[baras]

You're right. That does seem like the way to go. I have an idea of how this can be accomplished by creating a wrapper object that mimics a regular XMLHttpRequest object. That would give us access to all the details on the request and the response. I can look into it if you wouldn't mind.

[KradekMFC]

@ybaras You don't need to use an XMLHttpRequest. With a greasemonkey script it's just as if you are executing your script on the page, so all you need to do is tap into the message handler MFC has already defined.

I outlined a very basic example here. If you used that example you would want to look for messages of the type, FCTYPE_TOKENINC which is integer 6 (here is a list of most of the message types). Then make sure the message is for the model being counted (in case the user is in multiple rooms), and pass the tip off to handleTip with some revisions.

[msg4real]

I was thinking can we just make a check to to make sure ... style="background-color:#FFFF00; "> not some other color the.. I was able to post a
" style="background-color:#FFFF00;">

as a intern fix could we put a check on the class (make sure user is not posting)

        if (tipSpan.getAttribute('class').indexOf('chat_guest') === 0) {
            tipSpan.setAttribute('class', 'processed');
        }
        if (tipSpan.getAttribute('class').indexOf('chat_registered') === 0) {
            tipSpan.setAttribute('class', 'processed');
        }
        if (tipSpan.getAttribute('class').indexOf('chat_premium') === 0) {
            tipSpan.setAttribute('class', 'processed');
        }
        if (tipSpan.getAttribute('class').indexOf('chat_system') === -1) {
            return;
        }

Also You can also change the regex I think to something like below but adding a replace $$user$$ [the var is username in mfc] the is a username= part in very message but guest messages

tipRegex = "$$user$$ has tipped $$model$$ (.*) tokens.".replace("$$model$$", currentModelName).;