Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[All?] Fix exploit allowing color control characters to be used in chat under certain circumstances #1155

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

AndrewBetson
Copy link
Contributor

@AndrewBetson AndrewBetson commented Mar 26, 2025

Description

This PR fixes an oversight that causes the ReadChatTextString function to skip over color control characters if they are preceded by either of the hex color control codes.

This happens because the inner for-loop increments test one too many times, causing any following color control characters to be skipped over when the outer for-loop increments test, itself.

As far as I can tell, this effects all SDK2013 games.

The following screenshots use the example string �color!��FFD700test (0x07636F6C6F7221070546464437303074657374), generated with https://sourcecolors.neocities.org/

Before After
chat-color-before chat-color-after

@AzureWoof
Copy link

This doesn't seem all too harmful. Would much rather this be a feature, with some restrictions of course.

@origintopleft
Copy link

So far this has exactly one "malicious" use: Faking item drops. I learned about this when someone faked getting a Valve Rocket Launcher. (I chose something that doesn't actually exist in the game as proof of concept)

20250329150922_crop

I don't know how much this is considered a critical thing to fix, but if we can accept this as a thing people do, I'd vote in favor of people having colored text chat (if changed to something like Quake's system, with ^ suffixed by a value)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants