Page MenuHomeSchine - Phabricator
Create Task
Maniphest T2320

Starmade | despawn_ SQL exception
Closed, DuplicatePublic
Actions

Description

I get an SQL EXCEPTION if I attempt to despawn entities that posses an underscore, when entities of the same name exist that have a space instead of an underscore when using /despawn_all or /despawn_sector. (/destroy_entity, and /destroy_entity_dock work ok).

This has the potential to be an exploit on scripted servers, as it provides a way for players to potentially 'block' the deletion of certain objects for scripted events.

server stack trace:
[2017-04-01 10:20:11] [ADMIN COMMAND] DESPAWN_SECTOR from RegisteredClient: Jeryia (1) connected: true params: [test_thing, all, true, 100, 100, -100]
[2017-04-01 10:20:11] [DESPAWN] using escaped matching string 'test_thing%'
[2017-04-01 10:20:11] java.sql.SQLSyntaxErrorException: unknown token:
[2017-04-01 10:20:11] at org.hsqldb.jdbc.JDBCUtil.sqlException(Unknown Source)
[2017-04-01 10:20:11] at org.hsqldb.jdbc.JDBCUtil.sqlException(Unknown Source)
[2017-04-01 10:20:11] at org.hsqldb.jdbc.JDBCStatement.fetchResult(Unknown Source)
[2017-04-01 10:20:11] at org.hsqldb.jdbc.JDBCStatement.executeUpdate(Unknown Source)
[2017-04-01 10:20:11] at org.schema.game.common.controller.database.DatabaseIndex.a(SourceFile:3219)
[2017-04-01 10:20:11] at obfuscated.axH.q(SourceFile:1244)
[2017-04-01 10:20:11] at obfuscated.axH.a(SourceFile:1600)
[2017-04-01 10:20:11] at org.schema.game.server.controller.GameServerController.update(SourceFile:1021)
[2017-04-01 10:20:11] at org.schema.schine.network.server.ServerController.run(SourceFile:275)
[2017-04-01 10:20:11] at java.lang.Thread.run(Thread.java:745)
[2017-04-01 10:20:11] Caused by: org.hsqldb.HsqlException: unknown token:
[2017-04-01 10:20:11] at org.hsqldb.error.Error.error(Unknown Source)
[2017-04-01 10:20:11] at org.hsqldb.error.Error.error(Unknown Source)
[2017-04-01 10:20:11] at org.hsqldb.ParserBase.read(Unknown Source)
[2017-04-01 10:20:11] at org.hsqldb.ParserDQL.readColumnOrFunctionExpression(Unknown Source)
[2017-04-01 10:20:11] at org.hsqldb.ParserDQL.XreadSimpleValueExpressionPrimary(Unknown Source)
[2017-04-01 10:20:11] at org.hsqldb.ParserDQL.XreadAllTypesValueExpressionPrimary(Unknown Source)
[2017-04-01 10:20:11] at org.hsqldb.ParserDQL.XreadAllTypesPrimary(Unknown Source)
[2017-04-01 10:20:11] at org.hsqldb.ParserDQL.XreadAllTypesFactor(Unknown Source)
[2017-04-01 10:20:11] at org.hsqldb.ParserDQL.XreadAllTypesTerm(Unknown Source)
[2017-04-01 10:20:11] at org.hsqldb.ParserDQL.XreadAllTypesCommonValueExpression(Unknown Source)
[2017-04-01 10:20:11] at org.hsqldb.ParserDQL.XreadRowOrCommonValueExpression(Unknown Source)
[2017-04-01 10:20:11] at org.hsqldb.ParserDQL.XreadRowValuePredicand(Unknown Source)
[2017-04-01 10:20:11] at org.hsqldb.ParserDQL.XreadPredicateRightPart(Unknown Source)
[2017-04-01 10:20:11] at org.hsqldb.ParserDQL.XreadBooleanPrimaryOrNull(Unknown Source)
[2017-04-01 10:20:11] at org.hsqldb.ParserDQL.XreadBooleanTestOrNull(Unknown Source)
[2017-04-01 10:20:11] at org.hsqldb.ParserDQL.XreadBooleanFactorOrNull(Unknown Source)
[2017-04-01 10:20:11] at org.hsqldb.ParserDQL.XreadBooleanTermOrNull(Unknown Source)
[2017-04-01 10:20:11] at org.hsqldb.ParserDQL.XreadBooleanValueExpression(Unknown Source)
[2017-04-01 10:20:11] at org.hsqldb.ParserDML.XreadAndResolveBooleanValueExpression(Unknown Source)
[2017-04-01 10:20:11] at org.hsqldb.ParserDML.compileDeleteStatement(Unknown Source)
[2017-04-01 10:20:11] at org.hsqldb.ParserCommand.compilePart(Unknown Source)
[2017-04-01 10:20:11] at org.hsqldb.ParserCommand.compileStatements(Unknown Source)
[2017-04-01 10:20:11] at org.hsqldb.Session.executeDirectStatement(Unknown Source)
[2017-04-01 10:20:11] at org.hsqldb.Session.execute(Unknown Source)
[2017-04-01 10:20:11] ... 8 more
[2017-04-01 10:20:11] [SEND][SERVERMESSAGE] [ADMIN COMMAND] [ERROR] SQL EXCEPTION to RegisteredClient: Jeryia (1) connected: true

Details

Task Type
Bug
Testing Results
Affected Gamemode(s)
Multiplayer
Reproducible
Yes
Last tested (version)
0.199.492
Category
Engine
First occurrence (version)
0.199.491
Hardware/Software/System
OS-Specific
No
Hardware-Specific
No
Video Card Vendor
uncertain
Steps to reproduce
  1. Create an entity with a space in it's name. I used 'test thing'.

(eg) /spawn_entity "Isanth Type-Zero Mc" "test thing" 100 100 -100 -2 false

  1. Run the command /despawn_all test_thing all true
Clientconfig (settings.cfg)
 <replace this block with the file content, 
but do not remove the first and last line. 
Before using the paste function, mark the area from the 
opening angle bracket to the closing angle bracket>

Related Objects

Event Timeline

Jeryia created this task.Apr 1 2017, 4:23 PM
Jeryia added a comment.Apr 1 2017, 4:37 PM
This comment was removed by Jeryia.
Jeryia added a comment.EditedApr 1 2017, 5:13 PM

It appears that any despawn command attempting to remove something with a space in it fails.

I get this exception even if the despawn command is given a blank "" ship name, though it does successfully delete the entity. (unlike the previous example)

lancake moved this task from Unclassed to Archived on the Starmade board.Apr 3 2017, 12:09 PM
lancake added a subscriber: lancake.
lancake claimed this task.

Thank you for reporting this issue but that was already noticed in T2044. It only happens in the Pre-release candidates (0.199.491/0.199.492)
Merging tasks and updating info.

Restricted Application removed a project: Issue Navigation. · View Herald TranscriptApr 3 2017, 12:09 PM
lancake shifted this object from the S1 Public space to the S3 Starmade space.Apr 3 2017, 12:10 PM
lancake changed the visibility from "Custom Policy" to "Public (No Login Required)".
lancake changed the edit policy from "Task Author" to "Starmade (Project)".
lancake changed Category from none/unspecified to Engine.
lancake set First occurrence (version) to 0.199.491.
Restricted Application added a project: Engine. · View Herald TranscriptApr 3 2017, 12:10 PM