From eddb4416f7b055eb155abf8f003b6f538026a2a4 Mon Sep 17 00:00:00 2001 From: MikeIsAStar <99037623+MikeIsAStar@users.noreply.github.com> Date: Mon, 9 Sep 2024 23:55:00 -0400 Subject: [PATCH] SAKE: Validate the scores submitted in file uploads from Mario Kart Wii --- sake/mario_kart_wii.go | 6 +++--- schema.sql | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/sake/mario_kart_wii.go b/sake/mario_kart_wii.go index f7cb607..e7013f7 100644 --- a/sake/mario_kart_wii.go +++ b/sake/mario_kart_wii.go @@ -110,7 +110,7 @@ func handleMarioKartWiiGhostDownloadRequest(moduleName string, responseWriter ht } time, err := strconv.Atoi(timeString) - if err != nil || time <= 0 { + if err != nil || time <= 0 || time >= 360000 /* 6 minutes */ { logging.Error(moduleName, "Invalid time:", aurora.Cyan(timeString)) responseWriter.Header().Set(SakeFileResultHeader, strconv.Itoa(SakeFileResultMissingParameter)) return @@ -167,14 +167,14 @@ func handleMarioKartWiiGhostUploadRequest(moduleName string, responseWriter http return } courseId := common.MarioKartWiiCourseId(courseIdInt) - if courseId < common.MarioCircuit || courseId > 32767 { + if courseId < common.MarioCircuit || isContest == courseId.IsValid() || courseId > 32767 { logging.Error(moduleName, "Invalid course ID:", aurora.Cyan(courseIdString)) responseWriter.Header().Set(SakeFileResultHeader, strconv.Itoa(SakeFileResultMissingParameter)) return } score, err := strconv.Atoi(scoreString) - if err != nil || score <= 0 { + if err != nil || score <= 0 || score >= 360000 /* 6 minutes */ { logging.Error(moduleName, "Invalid score:", aurora.Cyan(scoreString)) responseWriter.Header().Set(SakeFileResultHeader, strconv.Itoa(SakeFileResultMissingParameter)) return diff --git a/schema.sql b/schema.sql index 56870fe..ec36213 100644 --- a/schema.sql +++ b/schema.sql @@ -59,7 +59,7 @@ ALTER TABLE public.users OWNER TO wiilink; CREATE TABLE IF NOT EXISTS public.mario_kart_wii_sake ( regionid smallint NOT NULL CHECK (regionid >= 1 AND regionid <= 7), courseid smallint NOT NULL CHECK (courseid >= 0 AND courseid <= 32767), - score integer NOT NULL CHECK (score > 0), + score integer NOT NULL CHECK (score > 0 AND score < 360000), pid integer NOT NULL CHECK (pid > 0), playerinfo varchar(108) NOT NULL CHECK (LENGTH(playerinfo) = 108), ghost bytea CHECK (ghost IS NULL OR (OCTET_LENGTH(ghost) BETWEEN 148 AND 10240)),