Apologies for the video link but I couldn't find a write-up yet. This is a (very) slightly more technical followup to the original story by Josh Strife Hayes on his channel, https://www.youtube.com/watch?v=f1v6vxENXbg
Basically Amazon's MMO New World has had numerous issues in trusting the client side UI code. This latest is that the chat box takes unsanitised HTML. This allows a variety of visual bugs, crashing game clients, and fake quest completions for infinite rewards.
This is on top of other recent bugs such as not receiving money for sales when offline, moving the window to 'pause' the game state and avoid damage, and other weird behaviour.
This is very a basic game development tenet - never trust the client. To see a company known for its APIs make all these mistakes is baffling.
Thanks for the write up. And I agree that this is just basic common sense stuff: NEVER trust user input! Not only that, but here we see yet another example of how using the web for desktop applications is not necessarily worth it. Sounds easy at first glance, but then this shit happens.
2 comments
[ 0.20 ms ] story [ 20.2 ms ] threadBasically Amazon's MMO New World has had numerous issues in trusting the client side UI code. This latest is that the chat box takes unsanitised HTML. This allows a variety of visual bugs, crashing game clients, and fake quest completions for infinite rewards.
This is on top of other recent bugs such as not receiving money for sales when offline, moving the window to 'pause' the game state and avoid damage, and other weird behaviour.
This is very a basic game development tenet - never trust the client. To see a company known for its APIs make all these mistakes is baffling.