drwily/gogobee
1
0
Fork 0
mirror of https://github.com/prosolis/gogobee.git synced 2026-07-15 16:42:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

N4/E2 review fixes: close a gift-enabled equip dupe; harden vault writes

Browse Source 
A high-effort code review of the gifting/vault work turned up three issues:

1. Item duplication (real exploit). The masterwork/arena equip confirmation
   captures an item at prompt time and equips it on "yes" without re-checking
   ownership. Since MasterworkGear/ArenaGear are now giftable, a player could
   !give the item away in the window, then confirm — minting a copy onto
   themselves while the recipient kept theirs. Fixed by taking the user lock
   (making gift-vs-confirm atomic) and re-loading the inventory to refuse an
   item that is no longer ours. Magic items are exempt (not giftable); other
   delete paths load-and-remove within one locked invocation.

2. clearAdvInventory read the vault-filtered list but its DELETE wiped every
   row including vaulted ones — no live caller today, but it would break the
   vault's "safe from !sell all" promise the instant sell-all routed through
   it. Delete now matches the read (in_vault = 0).

3. vault store/take took no per-user lock, so two near-simultaneous stores
   could both pass the capacity check and overfill the 10-slot vault. Now
   serialized on the same user lock the gift path uses.

go test ./... green; golden byte-identical.

Claude-Session: https://claude.ai/code/session_017mEwUmmS7aQTP2NQXj6rUa
This commit is contained in:
prosolis
2026-07-10 14:05:24 -07:00
parent 272f59aa32
commit 476384206e
3 changed files with 37 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
internal/plugin/adventure_masterwork.go
View File

@@ -492,8 +492,33 @@ func (p *AdventurePlugin) handleMasterworkEquipConfirm(ctx MessageContext, inter
return p.SendDM(ctx.Sender, "Equip cancelled.")
}
// Serialize against the sender's own !give: MasterworkGear/ArenaGear are
// giftable (N4/E2), so the item captured at prompt time may have changed
// hands before this confirmation. The lock makes gift-vs-confirm atomic,
// and the re-load below refuses an item that is no longer ours — otherwise
// equipping the captured copy would mint a duplicate the gift already
// handed to the recipient.
userMu := p.advUserLock(ctx.Sender)
userMu.Lock()
defer userMu.Unlock()
selected := data.Item
inv, err := loadAdvInventory(ctx.Sender)
if err != nil {
return p.SendDM(ctx.Sender, "Failed to load your inventory.")
}
stillOwned := false
for _, it := range inv {
if it.ID == selected.ID {
stillOwned = true
break
}
}
if !stillOwned {
return p.SendDM(ctx.Sender, fmt.Sprintf("**%s** isn't in your inventory anymore. Equip cancelled.", selected.Name))
}
equip, err := loadAdvEquipment(ctx.Sender)
if err != nil {
return p.SendDM(ctx.Sender, "Failed to load equipment.")