From 68ba8bc29db0bd00a344cb59fb3c25242e24c480 Mon Sep 17 00:00:00 2001
From: Kolya <40999563+Pa4ok@users.noreply.github.com>
Date: Fri, 12 Aug 2022 13:51:06 +0300
Subject: [PATCH] fix serialization exploit (#9)

---
 .../enderio/core/common/config/PacketConfigSync.java  | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/src/main/java/com/enderio/core/common/config/PacketConfigSync.java b/src/main/java/com/enderio/core/common/config/PacketConfigSync.java
index 271e033..b41f62b 100644
--- a/src/main/java/com/enderio/core/common/config/PacketConfigSync.java
+++ b/src/main/java/com/enderio/core/common/config/PacketConfigSync.java
@@ -1,5 +1,7 @@
 package com.enderio.core.common.config;
 
+import cpw.mods.fml.common.FMLCommonHandler;
+import cpw.mods.fml.relauncher.Side;
 import io.netty.buffer.ByteBuf;
 
 import java.io.ByteArrayInputStream;
@@ -50,9 +52,18 @@ public class PacketConfigSync implements IMessage {
     ByteBufUtils.writeUTF8String(buf, modid);
   }
 
+  /**
+   * Pa4ok
+   * you can trick forge network system & send client packet to server
+   * and then use different hacks with serialization of untrusted data
+   */
   @SuppressWarnings("unchecked")
   @Override
   public void fromBytes(ByteBuf buf) {
+    if(FMLCommonHandler.instance().getEffectiveSide() == Side.SERVER) {
+      return;
+    }
+
     short len = buf.readShort();
     byte[] compressedBody = new byte[len];