[Plus Emulator] Bot Speech Exploit Fix

[Verted]

Hi RaGEZONE,
I recently came across an "exploit" that allows users to bypass the bad HTML filter on bot speech setup.
Normally for example <font size="200"> and </font> would be blocked, but by simply using <FONT SIZE="200"> and </FONT> in capitals, you can bypass the filter. I also believe you can work around it with other variations too like "FoNT" or "fOnT" - but I do not remember. 200 is not the font size limit, you can make it go much higher and take up the whole screen. I have not tested this with alot of other HTML, but I'm sure this could be used to do much more malicious things.

It is shown here:

You must be registered to see links

Here's the fix which completely removes any form of string upon saving bot speeches.

Go to SaveBotActionEvent.cs and find:

[COLOR=#474B51]for (int i = 0; i <= SpeechData.Length - 1; i++)[/COLOR]
                        { [COLOR=#474B51]                            using (IQueryAdapter dbClient = DatabaseManager.GetQueryReactor())[/COLOR]

Replace that with:

[COLOR=#474B51]for (int i = 0; i <= SpeechData.Length - 1; i++)[/COLOR]                        {
                            SpeechData[i] = Regex.Replace(SpeechData[i], "<(.|\\n)*?>", string.Empty);
[COLOR=#474B51]                            using (IQueryAdapter dbClient = DatabaseManager.GetQueryReactor())[/COLOR]

Happy days.

 

[streamhotel]

This is old news. Already fixed clientside I thought. Which Habbo.swf revision you were using?

 

[Joopie]

This is old news. Already fixed clientside I thought. Which Habbo.swf revision you were using?

Fixing it serverside is always better than let the client handle stuff like this. It's oke as a first measurement against invalid input, but the server should always do it too!

 

[Verted]

This is old news. Already fixed clientside I thought. Which Habbo.swf revision you were using?

Plus Revision 2, not sure which production though. Can check this later if I can be fucked.

Fixing it serverside is always better than let the client handle stuff like this. It's oke as a first measurement against invalid input, but the server should always do it too!

True.

 

[The General]

Ever since bots were released this has been a issue on most emulators.

 

[Verted]

Ever since bots were released this has been a issue on most emulators.

No longer :8:

 

[Oliveri]

No longer :8:

Honestly, yes it is. You can still bypass the "protection" one way or another. Like in *rcturus it would be fixed with a simple while loop, but no one cares.

 

[DinamicUser]

I've tested this bug on Plus Emulator R2 by Sledmore and it are affect.

EDIT: Thank you for this fix.

 

[Gaby]

http://forum.ragezone.com/f353/mercury-emulator-fixes-edits-topic-1028223/index22.html#post8273713

2014 :star: