Merge pull request #184 from simoleo89/fix/guild-badge-packet-parts

fix(guilds): validate badge packets and memberships
2026-06-20 07:26:18 +00:00 · 2026-06-15 07:22:01 +02:00
parent 3282430b67 8db6281cc8
commit c199d805d8
7 changed files with 175 additions and 39 deletions
@@ -0,0 +1,63 @@
+package com.eu.habbo.habbohotel.guilds;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
+
+import com.eu.habbo.messages.ClientMessage;
+import io.netty.buffer.Unpooled;
+import org.junit.jupiter.api.Test;
+
+class GuildBadgeBuilderTest {
+    @Test
+    void buildsBadgeFromFlatPartTriplets() {
+        ClientMessage packet = messageWithInts(
+                1, 2, 4,
+                35, 8, 0
+        );
+
+        assertEquals("b001024s035080", GuildBadgeBuilder.readBadge(packet, 6));
+    }
+
+    @Test
+    void rejectsCountThatDoesNotRepresentCompleteTriplets() {
+        ClientMessage packet = messageWithInts(1, 2, 4);
+
+        assertNull(GuildBadgeBuilder.readBadge(packet, 4));
+    }
+
+    @Test
+    void rejectsPayloadShorterThanDeclaredCount() {
+        ClientMessage packet = messageWithInts(1, 2);
+
+        assertNull(GuildBadgeBuilder.readBadge(packet, 3));
+    }
+
+    @Test
+    void rejectsTooManyBadgeParts() {
+        ClientMessage packet = messageWithInts(
+                1, 1, 4,
+                2, 1, 4,
+                3, 1, 4,
+                4, 1, 4,
+                5, 1, 4,
+                6, 1, 4
+        );
+
+        assertNull(GuildBadgeBuilder.readBadge(packet, 18));
+    }
+
+    @Test
+    void rejectsPartValuesOutsideBadgeCodeRanges() {
+        assertNull(GuildBadgeBuilder.readBadge(messageWithInts(1000, 1, 4), 3));
+        assertNull(GuildBadgeBuilder.readBadge(messageWithInts(1, 100, 4), 3));
+        assertNull(GuildBadgeBuilder.readBadge(messageWithInts(1, 1, 9), 3));
+    }
+
+    private static ClientMessage messageWithInts(int... values) {
+        var buffer = Unpooled.buffer(values.length * Integer.BYTES);
+        for (int value : values) {
+            buffer.writeInt(value);
+        }
+        return new ClientMessage(0, buffer);
+    }
+}
@@ -0,0 +1,24 @@
+package com.eu.habbo.habbohotel.guilds;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+import org.junit.jupiter.api.Test;
+
+class GuildManagerMembershipContractTest {
+    private static String guildManagerSource() throws Exception {
+        return Files.readString(Path.of("src/main/java/com/eu/habbo/habbohotel/guilds/GuildManager.java"));
+    }
+
+    @Test
+    void acceptRequestOnlyPromotesPendingMembershipRows() throws Exception {
+        String source = guildManagerSource();
+
+        assertTrue(source.contains("UPDATE guilds_members SET level_id = ?, member_since = ? WHERE user_id = ? AND guild_id = ? AND level_id = ?"),
+                "accepting a guild request must only promote rows still in REQUESTED state");
+        assertTrue(source.contains("statement.setInt(5, GuildRank.REQUESTED.type);"),
+                "the accept-request update must bind the expected REQUESTED rank guard");
+    }
+}