CyclopsMC / CyclopsCore / 42257246303

31%

master-1.21: 31%

Pull #261

github

Restrict recipe display regex requests from clients

RequestRecipeDisplaysRegexPacket ran a client-provided regex against
every recipe id on the main thread, and sent one packet per match. A
backtracking regex could stall the server, and repeated requests sent
one packet per recipe each time.

The server now only accepts recipe ids and recipe id prefixes followed
by '.*', which match in linear time and cover all infobook appendix
lists. Requests are deduplicated and limited per connection, and the
done packet is always sent so the client does not keep waiting. The
regex is also compiled once instead of once per recipe.

Fixes GHSA-8469-hgvj-5g4r

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UeSuG5REz2JxHTZADcGhh2

1326 of 4641 branches covered (28.57%)

Branch coverage included in aggregate %.

3945 of 12137 relevant lines covered (32.5%)

1.59 hits per line