You've already forked Arcturus-Morningstar-Extended
mirror of
https://github.com/duckietm/Arcturus-Morningstar-Extended.git
synced 2026-06-20 23:36:19 +00:00
fix(polls): scope answers to active room poll
Require poll answer, cancel, and question-data packets to match the poll configured on the caller's current room. Previously a crafted packet could target any loaded poll id and submit the final question directly, including badge-reward polls, without being in a room where that poll was active. Keep word quiz handling null-safe and add a contract test covering current-room poll scoping for all poll handlers.
This commit is contained in:
+33
@@ -0,0 +1,33 @@
|
||||
package com.eu.habbo.messages.incoming.polls;
|
||||
|
||||
import org.junit.jupiter.api.Test;
|
||||
|
||||
import java.nio.file.Files;
|
||||
import java.nio.file.Path;
|
||||
|
||||
import static org.junit.jupiter.api.Assertions.assertTrue;
|
||||
|
||||
class PollRoomScopeContractTest {
|
||||
@Test
|
||||
void pollHandlersRequireMatchingCurrentRoomPoll() throws Exception {
|
||||
assertRequiresMatchingRoomPoll("AnswerPollEvent.java");
|
||||
assertRequiresMatchingRoomPoll("CancelPollEvent.java");
|
||||
assertRequiresMatchingRoomPoll("GetPollDataEvent.java");
|
||||
}
|
||||
|
||||
private void assertRequiresMatchingRoomPoll(String fileName) throws Exception {
|
||||
String source = Files.readString(Path.of("src/main/java/com/eu/habbo/messages/incoming/polls/" + fileName));
|
||||
int packetPollId = source.indexOf("int pollId = this.packet.readInt();");
|
||||
int pollLookup = source.indexOf("getPoll(pollId)");
|
||||
|
||||
assertTrue(packetPollId >= 0, fileName + " must read the poll id from the packet");
|
||||
assertTrue(pollLookup >= 0, fileName + " must look up the requested poll explicitly");
|
||||
|
||||
String guardedSection = source.substring(packetPollId, pollLookup);
|
||||
|
||||
assertTrue(guardedSection.contains("getCurrentRoom()"),
|
||||
fileName + " must bind poll actions to the caller's current room");
|
||||
assertTrue(guardedSection.contains("room == null || room.getPollId() != pollId"),
|
||||
fileName + " must reject poll ids that are not active in the current room");
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user