Script security - Revision history

Flox at 19:12, 8 January 2026

2026-01-08T19:12:19Z

← Older revision		Revision as of 19:12, 8 January 2026
Line 1,540:		Line 1,540:
	==Handling events spam==		==Handling events spam==
	See: [[onPlayerTriggerEventThreshold]]		See: [[onPlayerTriggerEventThreshold]]

			__NOTOC__
			__NOEDITSECTION__
			[[ru:Script security]]
			[[en:Script security]]

Srslyyyy: /* Securing setElementData */

2025-05-03T16:34:46Z

Securing setElementData

← Older revision		Revision as of 16:34, 3 May 2025
Line 232:		Line 232:
	local banBySerial = true -- only relevant if punishPlayerOnDetect and punishmentBan is set to true; (...) if there is a player serial to use instead		local banBySerial = true -- only relevant if punishPlayerOnDetect and punishmentBan is set to true; (...) if there is a player serial to use instead
	local banTime = 0 -- only relevant if punishPlayerOnDetect and punishmentBan is set to true; time in seconds, 0 for permanent		local banTime = 0 -- only relevant if punishPlayerOnDetect and punishmentBan is set to true; time in seconds, 0 for permanent
	local allowOnlyProtectedKeys = true -- disallow (remove by using removeElementData~~, if it didn't existed before~~) every element data besides those given in protectedKeys table; in case someone wanted to flood server with garbage keys, which would be kept in memory until server restart or manual remove - setElementData(source, key, nil) won't remove it; it has to be removeElementData		local allowOnlyProtectedKeys = true -- disallow (remove by using removeElementData) every element data besides those given in protectedKeys table; in case someone wanted to flood server with garbage keys, which would be kept in memory until server restart or manual remove - setElementData(source, key, nil) won't remove it; it has to be removeElementData
	local debugLevel = 4 -- this debug level allows to hide INFO: prefix, and use custom colors		local debugLevel = 4 -- this debug level allows to hide INFO: prefix, and use custom colors
	local debugR = 255 -- debug message - red color		local debugR = 255 -- debug message - red color

Srslyyyy: /* Securing projectiles & explosions */

2025-04-01T19:30:49Z

Securing projectiles & explosions

← Older revision		Revision as of 19:30, 1 April 2025
Line 1,089:		Line 1,089:
	local function reportProjectileAbnormality(playerElement, projectileType, projectileX, projectileY, projectileZ, projectileForce, projectileTarget, projectileRX, projectileRY, projectileRZ, projectileVX, projectileVY, projectileVZ, detectionCode)		local function reportProjectileAbnormality(playerElement, projectileType, projectileX, projectileY, projectileZ, projectileForce, projectileTarget, projectileRX, projectileRY, projectileRZ, projectileVX, projectileVY, projectileVZ, detectionCode)
	local projectileSyncer = inspect(playerElement)		local projectileSyncer = inspect(playerElement)
	local projectilePosition = (projectileX..", "..projectileY..", "..projectileZ)		local projectilePosition = projectileX..", "..projectileY..", "..projectileZ
	local projectileZoneName = getZoneName(projectileX, projectileY, projectileZ, false)		local projectileZoneName = getZoneName(projectileX, projectileY, projectileZ, false)
	local projectileCityName = getZoneName(projectileX, projectileY, projectileZ, true)		local projectileCityName = getZoneName(projectileX, projectileY, projectileZ, true)

Srslyyyy at 19:06, 31 March 2025

2025-03-31T19:06:28Z

← Older revision		Revision as of 19:06, 31 March 2025
Line 477:		Line 477:
	----------		----------
	<section name="Server" class="server" show="true">		<section name="Server" class="server" show="true">
	Example of ~~comfortable~~ anti-cheat function designed for events, used for data validation for both normal, and admin events which are called from client-side.		Example of anti-cheat function designed for events, used for data validation for both normal, and admin events which are called from client-side.
	<syntaxhighlight lang="lua">		<syntaxhighlight lang="lua">
	--[[		--[[

Srslyyyy: /* Detecting and dealing with backdoors and cheats */

2025-03-31T18:56:39Z

Detecting and dealing with backdoors and cheats

← Older revision		Revision as of 18:56, 31 March 2025
Line 47:		Line 47:
	* You shouldn't rely only on player [https://wiki.multitheftauto.com/wiki/Serial serial], when it comes to processing crucial operations (auto-login/admin actions). '''Serials aren't guaranted to be unique or non-fakable'''. This is why you should '''put it behind''' account system, as '''important authentication factor''' (e.g: '''login & password''').		* You shouldn't rely only on player [https://wiki.multitheftauto.com/wiki/Serial serial], when it comes to processing crucial operations (auto-login/admin actions). '''Serials aren't guaranted to be unique or non-fakable'''. This is why you should '''put it behind''' account system, as '''important authentication factor''' (e.g: '''login & password''').
	* Server-side logic '''can not be bypassed''' or '''tampered''' with (unless server is breached or when there is a bug in code, but that's whole different scenario) - '''use it to your advantage'''. In majority of cases, you will be able to perform security validations with no participation of client-side.		* Server-side logic '''can not be bypassed''' or '''tampered''' with (unless server is breached or when there is a bug in code, but that's whole different scenario) - '''use it to your advantage'''. In majority of cases, you will be able to perform security validations with no participation of client-side.
	* Using concept of '''''“All parameters including source can be faked and should not be trusted. Global variable client can be trusted.”''''' - gives you reliable assurance that player to which you refer (via '''client''') '''is''' in fact, '''the one which really called event'''. This approach will protect you from situations where cheater can call ~~(and~~ process) for instance: admin events (e.g kick/ban player) by passing the actual admin ('''2nd''' argument in '''[[triggerServerEvent]]'''), or trigger events for other players (as if they were the ones who called them, but in reality it was forcefully done by cheater) - as a consequence of using wrong variable. To make sure you fully understood it, take a look at examples below:		* Using concept of '''''“All parameters including source can be faked and should not be trusted. Global variable client can be trusted.”''''' - gives you reliable assurance that player to which you refer (via '''client''') '''is''' in fact, '''the one which really called event'''. This approach will protect you from situations where cheater can call & process for instance: admin events (e.g kick/ban player) by passing the actual admin ('''2nd''' argument in '''[[triggerServerEvent]]'''), or trigger events for other players (as if they were the ones who called them, but in reality it was forcefully done by cheater) - as a consequence of using wrong variable. To make sure you fully understood it, take a look at examples below:

	<syntaxhighlight lang="lua">		<syntaxhighlight lang="lua">

Srslyyyy: /* Detecting and dealing with backdoors and cheats */

2025-03-31T18:55:41Z

Detecting and dealing with backdoors and cheats

← Older revision		Revision as of 18:55, 31 March 2025
Line 47:		Line 47:
	* You shouldn't rely only on player [https://wiki.multitheftauto.com/wiki/Serial serial], when it comes to processing crucial operations (auto-login/admin actions). '''Serials aren't guaranted to be unique or non-fakable'''. This is why you should '''put it behind''' account system, as '''important authentication factor''' (e.g: '''login & password''').		* You shouldn't rely only on player [https://wiki.multitheftauto.com/wiki/Serial serial], when it comes to processing crucial operations (auto-login/admin actions). '''Serials aren't guaranted to be unique or non-fakable'''. This is why you should '''put it behind''' account system, as '''important authentication factor''' (e.g: '''login & password''').
	* Server-side logic '''can not be bypassed''' or '''tampered''' with (unless server is breached or when there is a bug in code, but that's whole different scenario) - '''use it to your advantage'''. In majority of cases, you will be able to perform security validations with no participation of client-side.		* Server-side logic '''can not be bypassed''' or '''tampered''' with (unless server is breached or when there is a bug in code, but that's whole different scenario) - '''use it to your advantage'''. In majority of cases, you will be able to perform security validations with no participation of client-side.
	* Using concept of '''''“All parameters including source can be faked and should not be trusted. Global variable client can be trusted.”''''' - gives you reliable assurance that player to which you refer (via '''client''') '''is''' in fact, '''the one which really called event'''. This approach will protect you from situations where cheater can call (and process) admin events (e.g kick/ban player) by passing the actual admin ('''2nd''' argument in '''[[triggerServerEvent]]''') - as a consequence of using wrong variable. To make sure you fully understood it, take a look at examples below:		* Using concept of '''''“All parameters including source can be faked and should not be trusted. Global variable client can be trusted.”''''' - gives you reliable assurance that player to which you refer (via '''client''') '''is''' in fact, '''the one which really called event'''. This approach will protect you from situations where cheater can call (and process) for instance: admin events (e.g kick/ban player) by passing the actual admin ('''2nd''' argument in '''[[triggerServerEvent]]'''), or trigger events for other players (as if they were the ones who called them, but in reality it was forcefully done by cheater) - as a consequence of using wrong variable. To make sure you fully understood it, take a look at examples below:

	<syntaxhighlight lang="lua">		<syntaxhighlight lang="lua">

Srslyyyy at 18:51, 31 March 2025

2025-03-31T18:51:29Z

← Older revision		Revision as of 18:51, 31 March 2025
Line 194:		Line 194:

	<section name="Server" class="server" show="true">		<section name="Server" class="server" show="true">
	Example of ~~comfortable~~ advanced element data anti-cheat.		Example of advanced element data anti-cheat.
	<syntaxhighlight lang="lua">		<syntaxhighlight lang="lua">
	--[[		--[[

Srslyyyy at 19:11, 21 March 2025

2025-03-21T19:11:52Z

← Older revision		Revision as of 19:11, 21 March 2025
Line 1,374:		Line 1,374:
	local explosionSyncer = inspect(playerElement)		local explosionSyncer = inspect(playerElement)
	local explosionType = explosionType		local explosionType = explosionType
	local explosionPosition = (explosionX..", "..explosionY..", "..explosionZ)		local explosionPosition = explosionX..", "..explosionY..", "..explosionZ
	local explosionZoneName = getZoneName(explosionX, explosionY, explosionZ, false)		local explosionZoneName = getZoneName(explosionX, explosionY, explosionZ, false)
	local explosionCityName = getZoneName(explosionX, explosionY, explosionZ, true)		local explosionCityName = getZoneName(explosionX, explosionY, explosionZ, true)

Srslyyyy: /* Securing triggerServerEvent */

2024-11-24T14:43:02Z

Securing triggerServerEvent

← Older revision		Revision as of 14:43, 24 November 2024
Line 467:		Line 467:
	* Global variable '''client''' can be trusted.		* Global variable '''client''' can be trusted.
	* '''Admin''' styled '''events''' should be verifying player (client) '''ACL rights''', either by [https://wiki.multitheftauto.com/wiki/IsObjectInACLGroup isObjectInACLGroup] or [https://wiki.multitheftauto.com/wiki/HasObjectPermissionTo hasObjectPermissionTo].		* '''Admin''' styled '''events''' should be verifying player (client) '''ACL rights''', either by [https://wiki.multitheftauto.com/wiki/IsObjectInACLGroup isObjectInACLGroup] or [https://wiki.multitheftauto.com/wiki/HasObjectPermissionTo hasObjectPermissionTo].
			* Do '''not''' use the same name for your custom event as MTA native server events (which aren't remotely triggerable by default), e.g: '''onPlayerLogin'''; doing so would open door for cheaters manipulations.
	* Be aware to which players event is sent via [[triggerClientEvent]]. For both security & performance reasons, admin like events should be received by admins only (to prevent confidential data being accessed), in the same time you shouldn't send each event to everyone on server (e.g: login success event which hides login panel for certain player). [[triggerClientEvent]] allows you to specify the event receiver as first (optional) argument. It defaults to [[root]], meaning if you don't specify it, it will be sent to everyone connected to server - even those who are still downloading server cache (which results in ''Server triggered clientside event eventName, but event is not added clientside.''). You can either pass player element or table with receivers:		* Be aware to which players event is sent via [[triggerClientEvent]]. For both security & performance reasons, admin like events should be received by admins only (to prevent confidential data being accessed), in the same time you shouldn't send each event to everyone on server (e.g: login success event which hides login panel for certain player). [[triggerClientEvent]] allows you to specify the event receiver as first (optional) argument. It defaults to [[root]], meaning if you don't specify it, it will be sent to everyone connected to server - even those who are still downloading server cache (which results in ''Server triggered clientside event eventName, but event is not added clientside.''). You can either pass player element or table with receivers:
	<syntaxhighlight lang="lua">		<syntaxhighlight lang="lua">

Srslyyyy: /* Securing setElementData */

2024-06-09T00:32:27Z

Securing setElementData

← Older revision		Revision as of 00:32, 9 June 2024
Line 125:		Line 125:
	* You should refrain from using [[element data]] everywhere, it should be only used when really necessary. It is advised to replace it with [[triggerClientEvent]] instead.		* You should refrain from using [[element data]] everywhere, it should be only used when really necessary. It is advised to replace it with [[triggerClientEvent]] instead.
	* If you still insist on using it, it is recommended to set '''4th''' argument in [[setElementData]] to '''false''' (disabling sync for this, certain data) and use subscriber mode - [[addElementDataSubscriber]], for both security & performance reasons described in [https://wiki.multitheftauto.com/wiki/Script_security#Securing_triggerServerEvent event section.]		* If you still insist on using it, it is recommended to set '''4th''' argument in [[setElementData]] to '''false''' (disabling sync for this, certain data) and use subscriber mode - [[addElementDataSubscriber]], for both security & performance reasons described in [https://wiki.multitheftauto.com/wiki/Script_security#Securing_triggerServerEvent event section.]
	{{Important Note\|Disabling sync however, doesn't fully protect data key. It would be still vulnerable by default, but in this case you are not leaving it in plain sight. Using [[getAllElementData]] or digging in RAM wouldn't expose it, since it won't be synced to client in first place. Therefore it needs to be added to anti-cheat as well.}}		{{Important Note\|Disabling sync however, doesn't fully protect data key. It would be still vulnerable by default, but in this case you are not leaving it in plain sight. Using [[getAllElementData]] or digging in RAM wouldn't expose it, since it won't be synced to client in first place. Therefore, it needs to be added to anti-cheat as well.}}
	* All parameters including '''source''' can be faked and should not be trusted.		* All parameters including '''source''' can be faked and should not be trusted.
	* Global variable '''client''' can be trusted.		* Global variable '''client''' can be trusted.