From 41d76ff757f15e2165da125c72a1b082e89953af Mon Sep 17 00:00:00 2001 From: Daniel Date: Thu, 21 Nov 2024 17:40:17 +0100 Subject: [PATCH] Prevent bypassing command permission with leading whitespace --- packages/host/src/Instance.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/packages/host/src/Instance.ts b/packages/host/src/Instance.ts index d5aa8ae9..5fbe09fb 100644 --- a/packages/host/src/Instance.ts +++ b/packages/host/src/Instance.ts @@ -377,9 +377,10 @@ rcon.print(game.table_to_json(players))`.replace(/\r?\n/g, " "); } async sendRcon(message: string, expectEmpty = false, plugin = "") { + const trimmedMessage = message.trim(); if ( !this.config.get("factorio.enable_script_commands") - && scriptCommands.find(cmd => message.startsWith(cmd)) + && scriptCommands.find(cmd => trimmedMessage.startsWith(cmd)) ) { throw new Error( "Attempted to use script command while disabled. See config factorio.enable_script_commands.\n" +