{"action":"created","issue":{"url":"https://api.github.com/repos/TrinityCore/TrinityCore/issues/22399","repository_url":"https://api.github.com/repos/TrinityCore/TrinityCore","labels_url":"https://api.github.com/repos/TrinityCore/TrinityCore/issues/22399/labels{/name}","comments_url":"https://api.github.com/repos/TrinityCore/TrinityCore/issues/22399/comments","events_url":"https://api.github.com/repos/TrinityCore/TrinityCore/issues/22399/events","html_url":"https://github.com/TrinityCore/TrinityCore/issues/22399","id":358291797,"node_id":"MDU6SXNzdWUzNTgyOTE3OTc=","number":22399,"title":"New Hack Exploit TC!","user":{"login":"Hir0shi","id":40237089,"node_id":"MDQ6VXNlcjQwMjM3MDg5","avatar_url":"https://avatars2.githubusercontent.com/u/40237089?v=4","gravatar_id":"","url":"https://api.github.com/users/Hir0shi","html_url":"https://github.com/Hir0shi","followers_url":"https://api.github.com/users/Hir0shi/followers","following_url":"https://api.github.com/users/Hir0shi/following{/other_user}","gists_url":"https://api.github.com/users/Hir0shi/gists{/gist_id}","starred_url":"https://api.github.com/users/Hir0shi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Hir0shi/subscriptions","organizations_url":"https://api.github.com/users/Hir0shi/orgs","repos_url":"https://api.github.com/users/Hir0shi/repos","events_url":"https://api.github.com/users/Hir0shi/events{/privacy}","received_events_url":"https://api.github.com/users/Hir0shi/received_events","type":"User","site_admin":false},"labels":[{"id":36087725,"node_id":"MDU6TGFiZWwzNjA4NzcyNQ==","url":"https://api.github.com/repos/TrinityCore/TrinityCore/labels/Branch-3.3.5a","name":"Branch-3.3.5a","color":"188846","default":false},{"id":893505092,"node_id":"MDU6TGFiZWw4OTM1MDUwOTI=","url":"https://api.github.com/repos/TrinityCore/TrinityCore/labels/Sub-Chat","name":"Sub-Chat","color":"e10c02","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":12,"created_at":"2018-09-08T12:35:59Z","updated_at":"2018-09-10T18:35:23Z","closed_at":null,"author_association":"NONE","body":"player tell me please wis me ! and i wis to player = Wow , Error!\r\n\r\ni see on chat.log \r\n\r\njust this!\r\n\r\nPlayer hitsho says (language 0): :||\r\n\r\n\r\nversion: https://github.com/TrinityCore/TrinityCore/commit/66a87c4642d25f27ca24254cfeb0a0c4b21036b1\r\n\r\nos: windows 2012 server"},"comment":{"url":"https://api.github.com/repos/TrinityCore/TrinityCore/issues/comments/420015862","html_url":"https://github.com/TrinityCore/TrinityCore/issues/22399#issuecomment-420015862","issue_url":"https://api.github.com/repos/TrinityCore/TrinityCore/issues/22399","id":420015862,"node_id":"MDEyOklzc3VlQ29tbWVudDQyMDAxNTg2Mg==","user":{"login":"Rochet2","id":468816,"node_id":"MDQ6VXNlcjQ2ODgxNg==","avatar_url":"https://avatars0.githubusercontent.com/u/468816?v=4","gravatar_id":"","url":"https://api.github.com/users/Rochet2","html_url":"https://github.com/Rochet2","followers_url":"https://api.github.com/users/Rochet2/followers","following_url":"https://api.github.com/users/Rochet2/following{/other_user}","gists_url":"https://api.github.com/users/Rochet2/gists{/gist_id}","starred_url":"https://api.github.com/users/Rochet2/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Rochet2/subscriptions","organizations_url":"https://api.github.com/users/Rochet2/orgs","repos_url":"https://api.github.com/users/Rochet2/repos","events_url":"https://api.github.com/users/Rochet2/events{/privacy}","received_events_url":"https://api.github.com/users/Rochet2/received_events","type":"User","site_admin":false},"created_at":"2018-09-10T18:35:23Z","updated_at":"2018-09-10T18:35:23Z","author_association":"CONTRIBUTOR","body":"The information on https://github.com/TrinityCore/TrinityCore/issues/22399#issuecomment-419645753 post seems troubling.\r\nIt seems that the message `Player hitsho says (language 0): :||` comes from the chat log `\"Player %s says (language %u): %s\"`, which suggests that the message the player sent was either `:||` or `:\\124\\124` or similar.\r\n\r\nHowever, I cannot reproduce a crash with these messages. Are you guys able to?\r\nEven if tickets would crash, it does not explain why a chat message would crash if severity is set to 3. Unless of course the crash was caused by something else than the message in the logs.\r\nWe may need more information on what happened.\r\n\r\n\r\nI took a look at the link filtering on blizz and on TC and it seems that there are a few things to improve with the current system to make it work properly and to match blizzard behavior. Making those changes _may_ not fix the this current issue however, as we do not know what causes it yet. Below you can see the info I gathered.\r\n\r\n### Blizz\r\nCurrent (8.0.1.27602) blizz behavior seems to be to completely ignore messages that contain links with invalid format.\r\nThe messages do not appear in chat when sent through a script. \r\nIf an item link is otherwise correct but has wrong name, the name is shown as text, but link is removed.\r\n\r\n(1) Example of invalid chat link that is ignored on blizz (crashes client if not filtered). Any invalid format or invalid ID seems to be included in this case.\r\n```\r\n/run SendChatMessage(\"\\124cFFDDD000\\124Hquest:\\124htest\\124h\\124r\", \"WHISPER\", nil, GetUnitName(\"PLAYER\"))\r\n```\r\n\r\n(2) Example of message that passes all checks on blizz (double pipe to escape pipe characters, will not crash)\r\n```\r\n/run SendChatMessage(\"\\124\\124cFFDDD000\\124\\124Hquest:\\124\\124htest\\124\\124h\\124\\124r\", \"WHISPER\", nil, GetUnitName(\"PLAYER\"))\r\n```\r\n\r\n(3) Example of message that contains valid link but invalid text, only \"asd\" without brackets is shown as normal text. If the brackets are not in the link or itemid doesnt exist then the message belongs to case 1 and is ignored.\r\n```\r\nblizz:\r\n/run SendChatMessage(\"\\124cffffffff\\124Hitem:2589::::::::20:71::::::\\124h[asd]\\124h\\124r\", \"WHISPER\", nil, GetUnitName(\"PLAYER\"))\r\n335 branch:\r\n/run SendChatMessage(\"\\124cffffffff\\124Hitem:6948:0:0:0:0:0:0:0:1\\124h[Hearthsssstone]\\124h\\124r\", \"WHISPER\", nil, GetUnitName(\"PLAYER\"))\r\n```\r\n\r\nImages should probably be blocked in all severity >= 1 since normally you cannot even send them with SendChatMessage and exploits can do this https://www.reddit.com/r/wow/comments/2nz2sr/somebody_broke_trade_chat/ or impersonate GM etc.\r\n\r\n### TC\r\ne5b8b1e99a4e7361be862ae6e1f29189907167e4\r\nTC severity 0: messages 1,2,3 pass checks\r\nTC severity 1: messages 1,2,3 pass checks\r\nTC severity 2: the message 1 and 3 pass but 2 does not pass. (not blizzlike, 2 should pass)\r\nTC severity 3: the message 1 and 3 does not pass but 2 passes. (not blizzlike, 3 should show text only without link)\r\n\r\nFrom https://github.com/TrinityCore/TrinityCore/issues/15302#issuecomment-132464861\r\n> perhaps we should set default level to 2 and make changes to link validator so it at least checks if it has the expected format (currently it does not do that) to prevent crashing clients\r\n\r\n### Suggested prioritized todo\r\n- [ ] make changes to link validator so you can use it to check link format only to prevent crash (for severity 2)\r\n- [ ] use the new link format checking and remove existing checks that are invalid and block messages with double pipes for severity 2\r\n- [ ] change default validation setting to check for link validity in config and in core (default to severity 2)\r\n- [ ] https://github.com/TrinityCore/TrinityCore/issues/22399#issuecomment-419723075 remove check ignoring from afk and dnd message, however make sure that commands are not parsed from the afk/dnd message (no clear reason why validity check was skipped in the first place\r\nhttps://github.com/TrinityCore/TrinityCore/commit/4b0ffeb0bd02c2be666a9712ec5597b1bcefb442)\r\n- [ ] https://github.com/TrinityCore/TrinityCore/issues/22399#issuecomment-419778588 add link validity check to ticket create packet handler\r\n- [ ] make changes to link validation so that correct link with wrong text returns only text (for severity 3)\r\n"}}
{"actor":{"display_login":"Rochet2"}}