jwpttcg66 / nettygameserver Goto Github PK

Hey there!

I belong to an open source security research community, and a member (@srikanthprathi) has found an issue, but doesn’t know the best way to disclose it.

If not a hassle, might you kindly add a SECURITY.md file with an email, or another contact method? GitHub recommends this best practice to ensure security issues are responsibly disclosed, and it would serve as a simple instruction for security researchers in the future.

Thank you for your consideration, and I look forward to hearing from you!

(cc @huntr-helper)

应改为： long begin = System.nanoTime();

Hello,

First of all i want to thank you for sharing your code.
But when I was operating some of my files, there was a NumberFormatException.
I found that it was thrown by the Integer.parseInt method in
game-common/src/main/java/com/snowcattle/game/common/util/ArrayUtils.java

public static Set<Integer> getIntegerSet(List<String> ids) {
		Set<Integer> list = new HashSet<Integer>();
		for(String key: ids){
			list.add(Integer.parseInt(key));
		}
		return list;
	}

There is also a potential null pointer exception in method
game-common/src/main/java/com/snowcattle/game/common/util/FileUtil.getConfigPath(String fileName), such as when the getResource(fileName) method return null

public static String getConfigPath(String fileName)
{
	ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
	return classLoader.getResource(fileName).getPath();
}

However, I didn't know that this exception would happen before, resulting in a sudden interruption of my operation,

so I suggest you add catch or throw to the source code An exception goes out, which is convenient for the caller to develop.

Thank you!

Hi, I am currently looking into projects on github which are parametrically misusing cryptographic APIs for my research and I came across a few instances in your project where I found such misuses. These misuses have been highlighted in research papers such as

• CDRep: Automatic Repair of Cryptographic Misuses in Android Applications

In your source code file DesEncrypter.java there is a function "DesEncrypter(String, byte[])" and at line 44:

KeySpec keySpec = new PBEKeySpec(passPhrase.toCharArray(), salt, iterationCount);

where the iterationCount defined is 17 which is not the recommended value i.e. 1000

In another file AES.java there are two functions encrypt(byte[], string) and decrypt(byte[], string) with following misuses at line 34 and 49:

Cipher cipher = Cipher.getInstance(AES);

First parameter (with value "AES") should be any of AES/{CBC, GCM, PCBC, CTR, CTS, CFB, OFB}

In another file MD5Util.java there are two functions encrypt(byte[], string) and decrypt(byte[], string) with following misuses at line 50:

MessageDigest md = MessageDigest.getInstance("MD5");

First parameter (with value "MD5") should be any of {SHA-256, SHA-384, SHA-512}

I believe fixing these issues would help your product be more secure.

Hello,
First of all i want to thank you for sharing your code.
But when I was operating some of my files, there were runtime exception of the type 'java.lang.RuntimeException' and 'java.lang.IlegalArgumentException'. The runtime exceptions were from methods:

1. com.snowcattle.game.common.util.getIntArrayAttriValue()

	public static int[] getIntArrayAttriValue(Element e, String attrName) {
		String[] temp = e.getAttributeValue(attrName).split(ARRAY_SEPARATOR);
		int[] result = new int[temp.length];
		for (int i = 0; i < temp.length; i++) {
			result[i] = Integer.valueOf(temp[i]);
		}
		return result;
	}

2. com.snowcattle.game.common.util.PropertyRawSet.getInt(java.lang.K,java.lang.int)

	public int getInt(K key, int defVal) {
		Number val = (Number) p.get(key);
		if (val == null) {
			return defVal;
		}
		return val.intValue();
	}

it might cause the program to crash. But the caller may not know these problems and may cause the program to crash suddenly.
so I suggest you add catch or throw to the source code An exception goes out, which is convenient for the caller to develop. Thank you!
The issue can be reproduced by 1. passing a non-number string 2. passing a value that can't be parsed to a Number class.

Hi,

We are developing a tool to check whether the dependencies' scopes in maven are set rightly and reasonably.

Our tools have found some issues in your project about scope setting in maven' pom.xml file.

• in game-core\pom.xml, com.101tec:zkclient scope should be test instead of compile.

Please help us confirm whether the above reports are right and explain why it should set like these.

Thanks a lot.

请问作者开源协议是什么？

像请问一下怎么打包成jar包放到linux环境下运行

在解析数据包的时候都没有做粘包处理

怎么每个.proto文件内容这么少，好像不齐全不完整，能提供完整的文件参考一下吗。谢谢。

你好，有一些代码是否拼写错误？ 可以申请一个修改权限吗？

比如Excutor是否错误？

还有protostuff包更新了，我想从com.dyuproject.protostuff变更到io.protostuff

@jwpttcg66
目前 Loggers 以静态工厂的形式提供 Logger 的访问，我想本意应是好管理日志, 对整个系统有哪些日志掌控性更好。
但从 OCP 的角度出发，代码应对扩展开放，而对增删类型的修改关闭。
同时现在 的 成员属性中，存在具体业务逻辑的日志定义，也就是说之后有新的日志需求还是要修改 Loggers .
基于以上分析，是不是 Logger 的定义还是内聚到对应的具体调用类里面会更好点呢？
同理 ServiceName

检测到 jwpttcg66/NettyGameServer 一共引入了36个开源组件，存在12个漏洞

漏洞标题：Apache Log4j 代码问题漏洞
缺陷组件：log4j:[email protected]
漏洞编号：CVE-2019-17571
漏洞描述：Apache Log4j是美国阿帕奇（Apache）基金会的一款基于Java的开源日志记录工具。
Apache Log4j 1.2版本中存在代码问题漏洞。攻击者可利用该漏洞执行代码。
国家漏洞库信息：https://www.cnvd.org.cn/flaw/show/CNVD-2020-00502
影响范围：[0, ∞)
最小修复版本：
缺陷组件引入路径：com.snowcattle.game:[email protected]>org.slf4j:[email protected]>log4j:[email protected]

另外还有12个漏洞，详细报告：https://mofeisec.com/jr?p=i9c327

还有 有没有一个各个主要模块的API说明文档呢？

请问可以提供一个跑起来的例子吗?包含redis,数据库的,最近在了解这方面的知识,谢谢.

public class GameTcpMessageProcessor implements ITcpMessageProcessor {
protected static final Logger log = Loggers.msgLogger;

/** 主消息处理器，处理服务器内部消息、玩家不属于任何场景时发送的消息 */
private final ITcpMessageProcessor mainMessageProcessor;

public GameTcpMessageProcessor(ITcpMessageProcessor messageProcessor) {
    mainMessageProcessor = messageProcessor;
}



@Override
public void directPutTcpMessage(AbstractNetMessage msg) {
    if (!GameServerRuntime.isOpen()) {
        log.info("【Direct put Receive but will not process because server not open】"	+ msg);
        return;
    }
    mainMessageProcessor.directPutTcpMessage(msg);
}

如何启动的消息处理器？
@OverRide
public void start() {
mainMessageProcessor.start();
}

@Override
public void stop() {
    mainMessageProcessor.stop();
}

}