Mojira Archive
MC-255004

Several ways to exploit validation of last messages are possible

There's actually a few vectors to exploit the chat chain's last messages, and i'll try my best to explain a couple of them here.

 

1: you may never send any ack at all:

this is likely WaI because a client can have everyone ignored and hence, see no one's messages

 

2: you may selectively ack, or ack only things very far into the past.

Again, server-side doesn't enforce any kind of timings, it only ensures that they go forwards (no out of order acks) but nothing prevents you from, in a conversation where message 20 is being sent, ack message 1. This will make any report on you simply seem as if the last thing you've seen is not even included in the report casting shadow over the whole report.

I get that this is needed for laggy connections, your client may actually be just seeing the messages that occured 20 messages ago just now, but there being no limit just opens for a lot of context manipulation.

Player A, msg 1: Some innocent question?
Player B, msg 1, : No, last-seen: []
Player A, msg 2: You admit to bad?
Player B, msg 2: Yes, last-seen [ Player A's msg 1 ]

Player A reports this, report looks like:
A) Some innocent question?
B) Yes

this can potentially create reports that look like false reports

Won't Fix

Pablete 1234

[Mojang] Gegy

2022-08-06, 02:18 PM

2024-12-02, 09:33 AM

2024-12-02, 09:33 AM

2

2

Plausible

Very Important

Platform

Social Interactions

1.19.2, 1.21

-