mirror of
https://github.com/clusterio/clusterio.git
synced 2026-11-13 15:14:52 +09:00
bbassieandClaude Opus 4.8
5b769adcc5
handleInstanceSaveDetailsUpdatesEvent trusted the instanceId in the event and in each SaveDetails without checking the instance was assigned to the sending host. InstanceSaveDetailsUpdatesEvent has host in its src list and validateIngress only checks the source host id, not the payload, so any authenticated host could corrupt another instance's controller-side save records. Repro: a host owning nothing sends the event with a SaveDetails for instance 1002 (on another host) to inject a bogus save, or sends empty updates with instanceId 1002 to make the delete-missing sweep wipe that instance's save list. Guard both paths: bail if event.instanceId names an instance not assigned to this host, and drop the whole event if any update is for an instance not assigned here. Matches handleInstanceStatusChangedEvent's bogus-update warning. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>