Skip to content

v0.0.502: Command Validation Security Fix

Choose a tag to compare

View all tags
@Pintuzoft Pintuzoft released this 30 Jun 02:18
· 111 commits to main since this release
v0.0.502
b9ce0a1

CRITICAL Security Fix: Command Injection Prevention

What's New

  • Command Validator: All custom commands from config files are now validated before execution
  • Safe Command Whitelist: Only approved CounterStrike commands are allowed (mp_, sv_, sm_, say, changelevel, map, kick, ban, unban, status, stats, etc.)
  • Dangerous Pattern Blocking: Prevents shell metacharacters (||, &&, ;, |, &, $, `, etc.) and path traversal
  • Audit Logging: All blocked commands are logged with detailed denial reasons

Security Benefits

  • Prevents remote code execution via malicious config files
  • Blocks common injection attack patterns
  • No legitimate commands affected (whitelist includes all normal operations)

Version Info

  • Target Framework: .NET 10.0
  • Dependencies: CounterStrikeSharp.API v1.0.369, MySqlConnector v2.4.0
  • Previous Issues Fixed: Database credential hiding (v0.0.501), HTTPS validation (v0.0.501)

Deployment Notes

  • Low risk: Validation only restricts dangerous commands, no behavior changes for legitimate operations
  • Safe to deploy during any window
  • Recommended: Deploy alongside v0.0.501 if not already running it
Assets 3
Loading