From 3c0f6bf004b2a707aed9591eca4f3999f56ee7cf Mon Sep 17 00:00:00 2001 From: oranges Date: Sun, 5 Jul 2020 21:39:12 +0000 Subject: [PATCH] Improve bad name sanitisation function This adds a sanity short circuit, such that if the string passed into the reject bad name function is 3 times the maximum length allowable for a name, this function will refuse to process it at all, instead of doing the character by character processing of the entire name before deciding it's over maximum length. --- code/__HELPERS/text.dm | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/code/__HELPERS/text.dm b/code/__HELPERS/text.dm index 1dcb1618ad1..a06db97cae2 100644 --- a/code/__HELPERS/text.dm +++ b/code/__HELPERS/text.dm @@ -135,7 +135,11 @@ var/charcount = 0 var/char = "" - + // This is a sanity short circuit, if the users name is three times the maximum allowable length of name + // We bail out on trying to process the name at all, as it could be a bug or malicious input and we dont + // Want to iterate all of it. + if(t_len > 3 * MAX_NAME_LEN) + return for(var/i = 1, i <= t_len, i += length(char)) char = t_in[i] switch(text2ascii(char))