#73 - 1 - pokebedrock/gobds - Forgejo: Beyond coding. We forge.

DayOfMagic commented

2026-06-27 15:11:27 +00:00

(Migrated from github.com)

1

Summary by CodeRabbit

Bug Fixes
- Improved handling of malformed player input so invalid packets are safely ignored instead of causing errors.
- Added validation to drop clearly invalid movement data and reduce unwanted session disruption.
- Blocked certain suspicious inbound packets before they are processed further.
Chores
- Updated the linting workflow to use a newer lint tool version.

1  ## Summary by CodeRabbit * **Bug Fixes** * Improved handling of malformed player input so invalid packets are safely ignored instead of causing errors. * Added validation to drop clearly invalid movement data and reduce unwanted session disruption. * Blocked certain suspicious inbound packets before they are processed further. * **Chores** * Updated the linting workflow to use a newer lint tool version.

coderabbitai[bot] commented

2026-06-27 15:11:41 +00:00

(Migrated from github.com)

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 96fe7742-588a-4158-9535-a865b7cef4a0

📥 Commits

Reviewing files that changed from the base of the PR and between ba93a9bf3b and c06b0dfca5.

📒 Files selected for processing (3)

.github/workflows/lint.yml
gobds/session/handler_player_auth_input.go
gobds/session/session.go

📝 Walkthrough

Walkthrough

Adds safe type assertion and sanity bounds checks to PlayerAuthInputHandler. Introduces a payload signature blocking mechanism in session.go that drops client packets matching a hardcoded hex signature for IDs 1 and 135. Downgrades golangci-lint-action from v2.7.2 to v1.60.1.

Changes

Packet Validation and Blocking

Layer / File(s)	Summary
PlayerAuthInput safe cast and sanity checks `gobds/session/handler_player_auth_input.go`	Replaces unsafe direct type assertion with a checked cast and nil guard; adds early cancellation when `BlockActions` exceeds 1000 or `Tick` is negative.
Session payload signature filter `gobds/session/session.go`	Adds `bytes`, `encoding/hex`, and `minecraft/protocol` imports; inserts an early filter in `handlePacket` for packet IDs 1 and 135; adds `matchesBlockedPayload` that hex-decodes a fixed signature, marshals the packet, and drops it if the signature is found.

CI Lint Version Downgrade

Layer / File(s)	Summary
golangci-lint action version `.github/workflows/lint.yml`	Changes `golangci/golangci-lint-action` `version` from `v2.7.2` to `v1.60.1`.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐇 Hoppity-hop through the packet stream,
Bad bytes beware of the blocking scheme!
A hex signature check, a marshal and scan,
Negative ticks? Cancelled per plan.
The linter steps back to an earlier day—
All safe, all clean, hip-hip-hooray! 🎉

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

Warning

⚠️ This pull request shows signs of AI-generated slop (redundant_comments, description_diff_mismatch). It has been flagged by CodeRabbit slop detection and should be reviewed carefully.

[![Review Change Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/smell-of-curry/gobds/pull/73?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)   > [!CAUTION] > ## Review failed > > The pull request is closed.  <details> <summary>ℹ️ Recent review info</summary> <details> <summary>⚙️ Run configuration</summary> **Configuration used**: defaults **Review profile**: CHILL **Plan**: Pro **Run ID**: `96fe7742-588a-4158-9535-a865b7cef4a0` </details> <details> <summary>📥 Commits</summary> Reviewing files that changed from the base of the PR and between ba93a9bf3be4e39ed179373eae4f393e3d8f9441 and c06b0dfca538ebf7c27d78af07994d169290c869. </details> <details> <summary>📒 Files selected for processing (3)</summary> * `.github/workflows/lint.yml` * `gobds/session/handler_player_auth_input.go` * `gobds/session/session.go` </details> </details> ---  <details> <summary>📝 Walkthrough</summary> ## Walkthrough Adds safe type assertion and sanity bounds checks to `PlayerAuthInputHandler`. Introduces a payload signature blocking mechanism in `session.go` that drops client packets matching a hardcoded hex signature for IDs 1 and 135. Downgrades `golangci-lint-action` from v2.7.2 to v1.60.1. ## Changes **Packet Validation and Blocking** |Layer / File(s)|Summary| |---|---| |**PlayerAuthInput safe cast and sanity checks** `gobds/session/handler_player_auth_input.go`|Replaces unsafe direct type assertion with a checked cast and nil guard; adds early cancellation when `BlockActions` exceeds 1000 or `Tick` is negative.| |**Session payload signature filter** `gobds/session/session.go`|Adds `bytes`, `encoding/hex`, and `minecraft/protocol` imports; inserts an early filter in `handlePacket` for packet IDs 1 and 135; adds `matchesBlockedPayload` that hex-decodes a fixed signature, marshals the packet, and drops it if the signature is found.| **CI Lint Version Downgrade** |Layer / File(s)|Summary| |---|---| |**golangci-lint action version** `.github/workflows/lint.yml`|Changes `golangci/golangci-lint-action` `version` from `v2.7.2` to `v1.60.1`.| ## Estimated code review effort 🎯 3 (Moderate) | ⏱️ ~20 minutes ## Poem > 🐇 Hoppity-hop through the packet stream, > Bad bytes beware of the blocking scheme! > A hex signature check, a marshal and scan, > Negative ticks? Cancelled per plan. > The linter steps back to an earlier day— > All safe, all clean, hip-hip-hooray! 🎉 </details>   <details> <summary>✨ Finishing Touches</summary> <details> <summary>🧪 Generate unit tests (beta)</summary> - [ ]  Create PR with unit tests </details> </details>   --- Thanks for using [CodeRabbit](https://coderabbit.ai?utm_source=oss&utm_medium=github&utm_campaign=smell-of-curry/gobds&utm_content=73)! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. <details> <summary>❤️ Share</summary> - [X](https://twitter.com/intent/tweet?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A&url=https%3A//coderabbit.ai) - [Mastodon](https://mastodon.social/share?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A%20https%3A%2F%2Fcoderabbit.ai) - [Reddit](https://www.reddit.com/submit?title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&text=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code.%20Check%20it%20out%3A%20https%3A//coderabbit.ai) - [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fcoderabbit.ai&mini=true&title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&summary=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code) </details> Comment `@coderabbitai help` to get the list of available commands.  > [!WARNING] > ⚠️ This pull request shows signs of AI-generated slop (redundant_comments, description_diff_mismatch). It has been flagged by CodeRabbit slop detection and should be reviewed carefully.

DayOfMagic commented

2026-06-27 15:11:56 +00:00

(Migrated from github.com)

ignore, wanted to merge for my fork

Pull request closed

Please reopen this pull request to perform a merge.

Rows
Columns

1 #73

Summary by CodeRabbit

Review failed

Walkthrough

Changes

Estimated code review effort

Poem

Pull request closed