gamedigz 0.3.4 → 0.3.5

package/dist/index.cjs

@@ -17453,6 +17453,26 @@ var beammp = class extends Core {
 
 // protocols/dayz.js
 var import_node_buffer6 = require("node:buffer");
+function dayzTitleHasControlGarbage(s) {
+  for (let i = 0; i < s.length; i++) {
+    const c = s.charCodeAt(i);
+    if (c < 32 && c !== 9 && c !== 10 && c !== 13) {
+      return true;
+    }
+  }
+  return false;
+}
+function dayzModTitleLooksLikeGameOrNameLeak(title, state) {
+  var _a;
+  const game = ((_a = state == null ? void 0 : state.raw) == null ? void 0 : _a.game) != null && String(state.raw.game).trim() || "";
+  const name = (state == null ? void 0 : state.name) != null && String(state.name).trim() || "";
+  for (const ref of [game, name]) {
+    if (ref.length >= 2 && title === ref.slice(1)) {
+      return true;
+    }
+  }
+  return false;
+}
 var dayz = class extends valve {
   async run(state) {
     if (!this.options.port)
@@ -17499,7 +17519,7 @@ var dayz = class extends valve {
       const key = reader.string();
       rules[key] = reader.string();
     }
-    state.raw.dayzMods = this.readDayzMods(import_node_buffer6.Buffer.from(dayZPayload));
+    state.raw.dayzMods = this.sanitizeDayzModsList(this.readDayzMods(import_node_buffer6.Buffer.from(dayZPayload)), state);
   }
   processQueryInfo(state) {
     if (!state.raw.tags) {
@@ -17551,7 +17571,7 @@ var dayz = class extends valve {
   }
   readDayzMods(buffer) {
     if (!buffer.length) {
-      return {};
+      return [];
     }
     this.logger.debug("DAYZ BUFFER");
     this.logger.debug(buffer);
@@ -17578,6 +17598,47 @@ var dayz = class extends valve {
     this.logger.debug("dayz buffer rest:", reader.rest());
     return mods;
   }
+  /**
+   * Drop entries that are clearly mis-parsed (binary in title, empty names) or
+   * non-objects. Steam Workshop titles are never empty for listed items; empty
+   * titles usually mean padding or misalignment after the real mod list.
+   * Also drops rows where the title is the server "game" or hostname string
+   * with the first character missing (rules blob misaligned with A2S strings).
+   */
+  sanitizeDayzModsList(mods, state) {
+    if (!Array.isArray(mods)) {
+      return [];
+    }
+    return mods.filter((mod) => {
+      if (mod == null || typeof mod !== "object") {
+        return false;
+      }
+      const rawTitle = mod.title;
+      if (typeof rawTitle !== "string") {
+        return false;
+      }
+      const title = rawTitle.trim();
+      if (!title) {
+        return false;
+      }
+      if (state != null && dayzModTitleLooksLikeGameOrNameLeak(title, state)) {
+        return false;
+      }
+      if (dayzTitleHasControlGarbage(rawTitle)) {
+        return false;
+      }
+      if ("workshopId" in mod) {
+        const id = mod.workshopId;
+        if (typeof id !== "number" || !Number.isFinite(id) || id <= 0) {
+          return false;
+        }
+      }
+      return true;
+    }).map((mod) => {
+      const title = typeof mod.title === "string" ? mod.title.trim() : mod.title;
+      return { ...mod, title };
+    });
+  }
   readDayzModsSection(reader, withHeader) {
     const out = [];
     const count = reader.uint(1);

package/package.json

@@ -32,7 +32,7 @@
         "require": "./dist/index.cjs"
     },
     "author": "GameDig Contributors",
-    "version": "0.3.4",
+    "version": "0.3.5",
     "repository": {
         "type": "git",
         "url": "https://github.com/gamedig/node-gamedig.git"

package/protocols/dayz.js

@@ -1,6 +1,32 @@
 import valve from './valve.js'
 import { Buffer } from 'node:buffer'
 
+/** C0 control / non-printable garbage (misaligned binary parsed as title). */
+function dayzTitleHasControlGarbage (s) {
+  for (let i = 0; i < s.length; i++) {
+    const c = s.charCodeAt(i)
+    if (c < 0x20 && c !== 0x09 && c !== 0x0a && c !== 0x0d) {
+      return true
+    }
+  }
+  return false
+}
+
+/**
+ * Some servers with no (or empty) mod payload mis-parse the A2S "game" / hostname
+ * string into the mod list with a 1-code-unit offset (missing first character).
+ */
+function dayzModTitleLooksLikeGameOrNameLeak (title, state) {
+  const game = (state?.raw?.game != null && String(state.raw.game).trim()) || ''
+  const name = (state?.name != null && String(state.name).trim()) || ''
+  for (const ref of [game, name]) {
+    if (ref.length >= 2 && title === ref.slice(1)) {
+      return true
+    }
+  }
+  return false
+}
+
 export default class dayz extends valve {
   async run (state) {
     if (!this.options.port) this.options.port = 27016
@@ -53,7 +79,7 @@ export default class dayz extends valve {
       rules[key] = reader.string()
     }
 
-    state.raw.dayzMods = this.readDayzMods(Buffer.from(dayZPayload))
+    state.raw.dayzMods = this.sanitizeDayzModsList(this.readDayzMods(Buffer.from(dayZPayload)), state)
   }
 
   processQueryInfo (state) {
@@ -109,7 +135,7 @@ export default class dayz extends valve {
 
   readDayzMods (/** Buffer */ buffer) {
     if (!buffer.length) {
-      return {}
+      return []
     }
 
     this.logger.debug('DAYZ BUFFER')
@@ -142,6 +168,48 @@ export default class dayz extends valve {
     return mods
   }
 
+  /**
+   * Drop entries that are clearly mis-parsed (binary in title, empty names) or
+   * non-objects. Steam Workshop titles are never empty for listed items; empty
+   * titles usually mean padding or misalignment after the real mod list.
+   * Also drops rows where the title is the server "game" or hostname string
+   * with the first character missing (rules blob misaligned with A2S strings).
+   */
+  sanitizeDayzModsList (mods, state) {
+    if (!Array.isArray(mods)) {
+      return []
+    }
+    return mods.filter((mod) => {
+      if (mod == null || typeof mod !== 'object') {
+        return false
+      }
+      const rawTitle = mod.title
+      if (typeof rawTitle !== 'string') {
+        return false
+      }
+      const title = rawTitle.trim()
+      if (!title) {
+        return false
+      }
+      if (state != null && dayzModTitleLooksLikeGameOrNameLeak(title, state)) {
+        return false
+      }
+      if (dayzTitleHasControlGarbage(rawTitle)) {
+        return false
+      }
+      if ('workshopId' in mod) {
+        const id = mod.workshopId
+        if (typeof id !== 'number' || !Number.isFinite(id) || id <= 0) {
+          return false
+        }
+      }
+      return true
+    }).map((mod) => {
+      const title = typeof mod.title === 'string' ? mod.title.trim() : mod.title
+      return { ...mod, title }
+    })
+  }
+
   readDayzModsSection (/** Reader */ reader, withHeader) {
     const out = []
     // Entry count is a raw byte; readDayzByte can mis-handle value 1 (0x01)