-
Notifications
You must be signed in to change notification settings - Fork 2.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
was not safe for net #2220
Comments
I'm curious if you actually managed to "crash" a server with this method, as testing this on a loaded server had no impact at all. (If you did, you could provide your crash dump.) Dropping this event client-side wouldn't make much sense as someone who would abuse this would already be able to execute arbitrary code. (Also the event handlers like Blocking those certain base events would still leave all other custom events open for this kind of approach. (Server frameworks have a lot of those generic event handlers.) Still curious if you managed to "crash" a server with this, as the dropping of such events should be lightweight. fivem/data/shared/citizen/scripting/lua/scheduler.lua Lines 162 to 167 in 47adce0
|
It won't crash, only will heavily load on CPU, also seems like you are running localhost so you don't get kicked for network event overflow. Normally you could not spam events every 0ms without getting kicked. |
So basically you can crash a server spamming TriggerServerEvent of the server events as playerDropped, playerJoining, explosionEvent, etc...
If there's a good amount of resources that handles that events the server will just crash. It could be a nice thing to like "whitelist" this events and prevent from using them on TriggerServerEvent
The text was updated successfully, but these errors were encountered: