f8873fb8fa
Finding 1 of the 2026-07-29 security review: hosting bound 0.0.0.0 -- every interface -- with no password and no encryption, so anyone who could reach the machine's port was handed a seat and the game state. New defcustom cg-net-host-address defaults to 127.0.0.1; the wide-open value remains available and its docstring says exactly what choosing it means. This converts "anyone who can reach you" into "someone you deliberately let in", and bounds Finding 4's unauthenticated memory-exhaustion route to local callers along the way. Test cgt-net-host-loopback-default checks both the default value and the actual bound address (process-contact :local). Against the previous code it fails with (void-variable cg-net-host-address); the old bind, captured before the patch: [0 0 0 0 PORT]. |
||
|---|---|---|
| .. | ||
| card-games-tests.el | ||