Security

Security guidance

Home · Protocol options · Performance

GameQ initiates outbound network connections and parses data controlled by remote servers. Treat both configuration and results as untrusted at application boundaries.

Do not expose an unrestricted query proxy

Never pass arbitrary public request parameters directly into host, query_port, master_servers, protocol type, timeouts, or credentials. An unrestricted endpoint can become:

• a server-side request forgery path into private networks;
• a UDP/TCP scanning primitive;
• a resource-exhaustion vector;
• a way to send requests to third-party services from your infrastructure.

Use application-owned server records or an allowlist. Validate addresses after DNS resolution, reject loopback/link-local/private ranges when they are outside the intended deployment, constrain ports, and limit which protocol types a caller may select.

DNS can change between validation and connection. For high-risk public services, resolve and store approved addresses under administrator control rather than accepting a hostname per request.

Protect credentials

Most established native query protocols use no credentials. Plugin-, web-, REST-, or master-backed protocols can additionally accept authentication tokens, administration codes, usernames/passwords, or private service destinations. Treat every such value as a secret or privileged configuration, regardless of its option name.

Load secrets from a secret manager or protected environment/configuration store. Keep them out of client-side code, URLs shown to users, repositories, exception pages, analytics, and public fixtures.

Palworld uses plaintext HTTP

The Palworld REST API queried by this implementation uses HTTP Basic authentication over plaintext HTTP. Run it only across a trusted/private network or a network tunnel. Firewall the REST port from the public internet and do not reuse the administrator password elsewhere.

Treat result text as hostile

Hostnames, map names, player names, rules, and metadata originate outside your trust boundary. Before presentation:

echo htmlspecialchars($server['gq_hostname'] ?? '', ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');

Do not concatenate result values into SQL, shell commands, HTML attributes, file paths, log formats, or templates without the context-appropriate encoding or parameterization.

Bound workload

GameQ includes response, packet, decompression, follow-up, and batch limits, but the application must also enforce:

• a maximum number of servers per job and per tenant;
• rate limits and authentication;
• queue timeouts and worker memory limits;
• cache intervals;
• a controlled protocol allowlist;
• monitoring for repeated failures and unusually large responses.

Do not let callers set max_servers_per_batch, max_follow_up_rounds, or timeouts to unbounded values.

Debugging and packet capture

Debug exceptions and captured packets may expose server addresses, hostnames, rules, player or channel data, protocol metadata, and occasionally credentials. This applies equally to older UDP/TCP protocols and newer service-backed implementations. Keep debug mode off in user-facing production requests. Store captures outside the web root with restricted permissions and delete them according to your data-retention policy.

Dependencies and updates

Run:

composer audit
composer validate --strict

Keep PHP, Composer dependencies, the game server, and query plugins updated. Query formats can change without a GameQ release; review fixture-backed parser changes carefully instead of disabling validation.

Responsible reporting

Report a suspected vulnerability privately to the fork maintainer before publishing details that enable exploitation. A normal parsing bug without security impact can go to GitHub Issues, but remove credentials and sensitive network information first.