sid-ramakrishnan / gomoku-desktop Goto Github PK

In File : Gomoku-Desktop/server/src/main/java/com/gomoku/server/redis/model/Room.java

For method joinRoom the body automatically ignores any exception of type Exception, which is dangerous because it will mask critical programming errors.

 public boolean joinRoom(String audience){
        try{
            this.audience.add(audience);
            return true;
        }catch (Exception e){
            //System.out.println(e);
            return false;
        }
    }

In file : Gomoku-Desktop/server/src/main/java/com/gomoku/server/websocket/model/GameStatus.java

The getAudience method insecurely returns a mutable field object (Set). For security concerns this can lead to uncontrolled modification of the object by a user. This can be fixed by returning a copy of the the audience set instead of the original set.

public Set<WebSocketSession> getAudience() {
        return audience;
   }

In file: Gomoku-Desktop/server/src/main/java/com/gomoku/server/redis/model/Room.java

In the following code we see the public class Room, and a public void method also called Room. This public void method was most likely meant to be a constructor, so to fix this just delete the void in the Room method to make it a constructor.

public class Room implements Serializable {
    @Id
    private String roomName;
    private String master;
    private String guest;
    private Set<String> audience;
    private boolean playing;
    private String gameNo;

    public void Room(String roomName, String master){
        this.roomName = roomName;
        this.master = master;
        this.audience = new HashSet<>();
    }