Comments (4)
除上面所述外,浏览器也是一个攻击面。如果 Yggdrasil 服务端返回的图像没有指明 content-type,那么攻击者可以进行 content-type sniffing 攻击。
解决方法:服务端指明材质的 content-type 为 image/png
。
我会在 yggdrasil-mock 的测试样例中增加对此漏洞的检测。
from authlib-injector.
已在 1a94cd7f9578e6510425a2c470b5c4d246017dd8
中增加对用户上传材质安全性的说明。
from authlib-injector.
关于防止 content-type sniffing 攻击的提醒已添加到文档。a84d9f25383ca3b7ae65929113ff560b0ae0e5e2
from authlib-injector.
已在 yushijinhun/yggdrasil-mock@3d35c78 中添加对 Content-Type
的检查。
from authlib-injector.
Related Issues (20)
- 如果在velocity-3.3.0-SNAPSHOT-325中使用authlib-injector-1.2.4会出现身份验证服务宕机问题 HOT 2
- Httpd failed to start HOT 11
- 关于api错误返回的信息问题
- 无法使用游戏内聊天:由于个人信息公钥丢失,聊天已被禁用。请尝试重新连接。 HOT 1
- Authlib-injector not having a velocity-plugin.json file HOT 1
- The skin is used as a cape HOT 1
- 1.7.2-1.7.5 cannot display capes
- 玩家尝试进入服务器时报错 HOT 1
- 貌似是因为java信任库的原因,部分验证服务器的ssl证书无法验证,导致站点无法访问
- Minecraft 1.20.5 and 1.20.6 support HOT 2
- using multiple authservers HOT 7
- 启动后,客户端无法加入服务器,已在客户端设置好 littleskin 了。 HOT 2
- 无法从服务器正确获取数据
- Failed to fetch metadata
- No skins and failed to request yggdrasil public key ely by client HOT 2
- Introduce a separate field for the signature key of player certificates HOT 1
- 是不是不支持最近版的MC1.21,显示“验证用户名失败!” HOT 2
- Lookup skins by player name on "offline" servers HOT 7
- 使用Neoforge以及Forge服务端时启动服务端显示"Failed to fetch metadata: java.net.ConnectException: Connection timed out: connect"
- blocked domain HOT 4
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from authlib-injector.