From 67e01aab85607b9e601185c7d62dff576af3bb43 Mon Sep 17 00:00:00 2001 From: historia <[not public]> Date: Fri, 18 Sep 2026 15:42:23 -0400 Subject: fix: close map OOM, admin traversal, transport safespot, room rekey, and legacy payout recovery --- internal/admin/server.go | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'internal/admin/server.go') diff --git a/internal/admin/server.go b/internal/admin/server.go index 4ea22d8..c13fe96 100644 --- a/internal/admin/server.go +++ b/internal/admin/server.go @@ -389,6 +389,12 @@ func (s *AdminServer) checkAuth(r *http.Request) bool { return false } account := parts[0] + // The account name is attacker-controlled (it comes from the cookie) and + // is joined into players/accounts/.yaml by isAdminAccount below, + // so reject path-like names before the first join. + if err := player.ValidName(account); err != nil { + return false + } issued, err := strconv.ParseInt(parts[1], 10, 64) if err != nil { return false -- cgit v1.2.3