Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Wire entities not checking permission before creating constraint lead to exploit with AdvDupe2 #2973

Open
Bonyoze opened this issue Jan 8, 2024 · 0 comments
Labels
Bug Component Suggestion for a new component, or an existing one.

Comments

@Bonyoze
Copy link
Contributor

Bonyoze commented Jan 8, 2024

Describe the bug
The Wire Socket and Wire Plug create a weld constraint between one another without checking WireLib.CanTool. This lets anyone create a plug and link it to another player's socket, allowing them to copy the entire build with AdvDupe2, despite the player not giving permission at all.

The Wire Grabber does check WireLib.CanTool but only for its owner and not the owner of the prop being grabbed. However, it still prevents duplication of the constrained entities since it overwrites the type of the constraint.

local const = constraint.Weld(self, trace.Entity, 0, 0, self.WeldStrength)
if const then
const.Type = "" --prevents the duplicator from making this weld
end

To Reproduce
Steps to reproduce the behavior: Make sure both players do not have permission to touch each other's props

  1. Have Player1 place a Wire Socket on their own build
  2. Have Player2 spawn a Wire Plug and link it to the socket
  3. Have Player2 copy the plug with AdvDupe2
  4. The entire build belonging to Player1 should now be copied by Player2

Expected behavior
Both owners should need to give tool permission for the constraint to be created. Optionally the constraint type can be overwritten to prevent duplication of it and the other connected entities entirely.

@thegrb93 thegrb93 added Bug Component Suggestion for a new component, or an existing one. labels Mar 28, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Bug Component Suggestion for a new component, or an existing one.
Projects
None yet
Development

No branches or pull requests

2 participants