Skip to content

Commit

Permalink
Harden JsonMapper on login JSON handling
Browse files Browse the repository at this point in the history
  • Loading branch information
dktapps committed Feb 23, 2024
1 parent e06b042 commit 6872661
Show file tree
Hide file tree
Showing 4 changed files with 19 additions and 16 deletions.
2 changes: 1 addition & 1 deletion composer.json
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@
"ext-zlib": ">=1.2.11",
"composer-runtime-api": "^2.0",
"adhocore/json-comment": "~1.2.0",
"pocketmine/netresearch-jsonmapper": "~v4.2.1000",
"pocketmine/netresearch-jsonmapper": "~v4.4.999",
"pocketmine/bedrock-block-upgrade-schema": "~3.5.0+bedrock-1.20.60",
"pocketmine/bedrock-data": "~2.8.0+bedrock-1.20.60",
"pocketmine/bedrock-item-upgrade-schema": "~1.7.0+bedrock-1.20.60",
Expand Down
29 changes: 14 additions & 15 deletions composer.lock

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 2 additions & 0 deletions src/network/mcpe/auth/ProcessLoginTask.php
Original file line number Diff line number Diff line change
Expand Up @@ -135,6 +135,7 @@ private function validateToken(string $jwt, ?string &$currentPublicKey, bool $fi
$mapper = new \JsonMapper();
$mapper->bExceptionOnMissingData = true;
$mapper->bExceptionOnUndefinedProperty = true;
$mapper->bStrictObjectTypeChecking = true;
$mapper->bEnforceMapType = false;

try{
Expand Down Expand Up @@ -181,6 +182,7 @@ private function validateToken(string $jwt, ?string &$currentPublicKey, bool $fi
$mapper = new \JsonMapper();
$mapper->bExceptionOnUndefinedProperty = false; //we only care about the properties we're using in this case
$mapper->bExceptionOnMissingData = true;
$mapper->bStrictObjectTypeChecking = true;
$mapper->bEnforceMapType = false;
$mapper->bRemoveUndefinedAttributes = true;
try{
Expand Down
2 changes: 2 additions & 0 deletions src/network/mcpe/handler/LoginPacketHandler.php
Original file line number Diff line number Diff line change
Expand Up @@ -169,6 +169,7 @@ protected function fetchAuthData(JwtChain $chain) : AuthenticationData{
$mapper->bEnforceMapType = false; //TODO: we don't really need this as an array, but right now we don't have enough models
$mapper->bExceptionOnMissingData = true;
$mapper->bExceptionOnUndefinedProperty = true;
$mapper->bStrictObjectTypeChecking = true;
try{
/** @var AuthenticationData $extraData */
$extraData = $mapper->map($claims["extraData"], new AuthenticationData());
Expand Down Expand Up @@ -197,6 +198,7 @@ protected function parseClientData(string $clientDataJwt) : ClientData{
$mapper->bEnforceMapType = false; //TODO: we don't really need this as an array, but right now we don't have enough models
$mapper->bExceptionOnMissingData = true;
$mapper->bExceptionOnUndefinedProperty = true;
$mapper->bStrictObjectTypeChecking = true;
try{
$clientData = $mapper->map($clientDataClaims, new ClientData());
}catch(\JsonMapper_Exception $e){
Expand Down

0 comments on commit 6872661

Please sign in to comment.