What happened?
A client with any _non_game_messages.keys() tags can Connect to a server without validating the game argument. However, after authenticating this way, a client can then issue a ConnectUpdate packet that lacks any of these tags, which the server will not validate, meaning it can slip in an invalid game or potentially an incompatible version, depending on the slot's game.
What were the expected results?
Consistent validity checks of a client's tags. Probably a client that initially authenticates without a game it cares about (and thus hints/tracks/views) should not be allowed to later update its connection to care about the slot's game, and version check should probably be redone to guarantee the client didn't sneak past a lower barrier to entry while authenticating.
Software
While playing
What happened?
A client with any
_non_game_messages.keys()tags canConnectto a server without validating the game argument. However, after authenticating this way, a client can then issue aConnectUpdatepacket that lacks any of these tags, which the server will not validate, meaning it can slip in an invalid game or potentially an incompatible version, depending on the slot's game.What were the expected results?
Consistent validity checks of a client's tags. Probably a client that initially authenticates without a game it cares about (and thus hints/tracks/views) should not be allowed to later update its connection to care about the slot's game, and version check should probably be redone to guarantee the client didn't sneak past a lower barrier to entry while authenticating.
Software
While playing