Skip to content

Release v0.5.19

Choose a tag to compare

View all tags
@github-actions github-actions released this 17 Mar 18:58
· 97 commits to refs/heads/main since this release
v0.5.19
55ef192

Important

🛡️ Security Hardening & Major Plugin Refactoring

This release includes critical security fixes for command injection and path traversal vulnerabilities, a complete deep-level refactoring of 57 C++ handler files with centralized utilities, and removal of the WebAssembly integration.

🛡️ Security

🔒 Command Injection Prevention (#288)
Component Change
sanitizeCommandArgument() Added semicolon sanitization to prevent command chaining attacks
Physics Tools Sanitized constraint names, actor names, vehicle names, destruction names
Animation Tools Sanitized state machine names, state names, transition conditions
System Handlers Sanitized vehicle type, save paths, and all user-provided strings

Attack Vector Blocked: Input like "name;quit" can no longer execute arbitrary commands.

🔒 Path Traversal Fixes (#271, #282)
Component Change
validateSnapshotPath() Fixed bypass where paths equal to CWD (without trailing separator) were incorrectly rejected
Asset Handlers Added path sanitization to prevent traversal attacks
Blueprint Creation Added savePath sanitization
🔒 GraphQL CORS Hardening
Component Change
Default CORS Changed from permissive '*' to safe loopback origins
Allowed Origins localhost:4000, 127.0.0.1:4000, localhost:3000, 127.0.0.1:3000
Warning Added security warning when '*' is explicitly configured

🔧 Changed

🏗️ Complete C++ Plugin Refactoring (#280)

Deep line-by-line refactoring of 57 handler files and 8 infrastructure files:

New Infrastructure File Purpose
McpHandlerUtils.h/cpp Standardized JSON response builders (1,900 lines)
McpPropertyReflection.h/cpp Property reflection utilities (1,356 lines)
McpSafeOperations.h Safe asset/level save for UE 5.7 (659 lines)
McpVersionCompatibility.h UE 5.0-5.7 API compatibility macros (225 lines)
McpHandlerDeclarations.h Forward declarations (844 lines)
McpAutomationBridge_ConsoleCommandHandlers.cpp Batch and single command execution (302 lines)

Bugs Fixed During Refactoring:

  • EditorFunctionHandlers: use-after-free bug
  • EffectHandlers: truncated condition + missing braces
  • InventoryHandlers: duplicate TArray with undefined variables
  • MaterialAuthoringHandlers: duplicate include + missing UE 5.0 fallback
  • NavigationHandlers: case-sensitivity error
  • SkeletonHandlers: duplicate verification + redundant code
  • WidgetAuthoringHandlers: unreachable code block
⚡ Performance Improvements (#283)
Component Change
Batch Console Commands New batch execution API for parallel command processing
validate_assets Changed from sequential to Promise.all concurrent validation
State Machine Creation States now added in parallel instead of sequentially
🗑️ WebAssembly Integration Removed (#240)

Removed WebAssembly (wasm-pack/Rust) integration:

  • Deleted src/wasm/ directory (874 lines)
  • Deleted wasm/ Rust crate (1,500+ lines)
  • Removed WASM dependency from all handlers
  • Native C++ handlers provide equivalent functionality

🛠️ Fixed

🐛 Blueprint Inspect Crash (#270)
Bug Fix
Blueprint inspect crashed when variable list exceeded buffer Fixed truncated variable list handling
Function library blueprints not supported Added function library blueprint support (#258)
🐛 GAS Duplicate Effect Creation (#251)
Bug Fix
create_gameplay_effect assertion failure on duplicates Prevented duplicate GameplayEffect creation
🐛 Volume Handler Mobility
Bug Fix
Volume attachment failed for movable actors Added mobility check for target actors in volume handlers
🐛 UE 5.7 Compatibility (#274)
Bug Fix
GeometryScript AppendCapsule compile error on UE 5.5+ Added version guard for segment steps parameter
🐛 Action Name Alignment (#253)
Bug Fix
TypeScript action names mismatched C++ handlers Aligned all action names with C++ handler expectations

🗑️ Removed

Deprecated Tool Files

Removed deprecated standalone tool files (consolidated into handlers):

  • src/tools/audio.ts → src/tools/handlers/audio-handlers.ts
  • src/tools/debug.ts → consolidated into system handlers
  • src/tools/introspection.ts → src/tools/handlers/inspect-handlers.ts
  • src/tools/materials.ts → src/tools/handlers/material-authoring-handlers.ts
  • src/tools/performance.ts → src/tools/handlers/performance-handlers.ts
  • src/tools/ui.ts → consolidated into widget handlers
  • src/tools/input.ts → src/tools/handlers/input-handlers.ts
  • src/tools/behavior-tree.ts → consolidated
  • src/tools/engine.ts → consolidated

🔄 Dependencies

NPM Package Updates
Package From To PR
hono 4.12.0 4.12.7 #261, #277
express-rate-limit 8.2.1 8.3.0 #269
@types/node Various updates Multiple PRs
GitHub Actions Updates
Package From To PR
release-drafter/release-drafter 6.2.0 7.0.0 #286
softprops/action-gh-release 2.5.0 2.5.3 #287
actions/setup-node 6.2.0 6.3.0 #257
github/codeql-action 4.32.5 4.32.6 #266

📊 Statistics

  • Commits: 55 non-merge commits
  • Files Changed: 185 files
  • Lines Added: ~30,280
  • Lines Removed: ~20,440
  • New C++ Infrastructure: 5 files (~4,900 lines)
  • Bugs Fixed: 15+
  • Security Fixes: 4 critical

New Contributors

Full Changelog: v0.5.18...v0.5.19

Contributors

BeegHero and bytecodesky
Assets 8
Loading