fix: harden engine across casino, economy, concurrency, security, and content

1 files changed, 12 insertions, 1 deletions

diff --git a/internal/config/config.go b/internal/config/config.go
index 362c9c1..852a6d6 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -3,6 +3,9 @@
 package config
 
 import (
+	"bytes"
+	"errors"
+	"io"
 	"os"
 
 	"gopkg.in/yaml.v3"
@@ -242,7 +245,15 @@ func Load(path string) (*Config, error) {
 		return nil, err
 	}
 	cfg := Default()
-	if err := yaml.Unmarshal(data, cfg); err != nil {
+	// KnownFields makes a misspelled key (e.g. telnet_listen) a hard error
+	// instead of silently leaving the default in place. ColorsConfig is a map,
+	// so arbitrary color keys remain allowed.
+	dec := yaml.NewDecoder(bytes.NewReader(data))
+	dec.KnownFields(true)
+	// An empty or comment-only file yields io.EOF, which means "no keys set"
+	// rather than a broken config: the defaults above stay in effect. A real
+	// syntax/unknown-field error is still returned.
+	if err := dec.Decode(cfg); err != nil && !errors.Is(err, io.EOF) {
 		return nil, err
 	}
 	return cfg, nil