Ottoswap

I havent looked at this much but my biggest question would be why the heck is there any info being sent off the client at all? I thought that was a nice looking visual aid for the gearswap files. Guess it isnt?

I use AI a lot for coding stuff like simple addons, doing code audits, etc. I learned a lot and use a lot of what it suggests. I am no pro coder but can understand it's decisions.

What i like most about using AI personally is getting a new perspective or brainstorming and flushing out an idea. Lot of the time I dont know really want I want or best way to make it happen. AI has been helpful for me at least. I do try and be careful with it. No packet injection, no functions or code i cant understand after reading or asking for a break down. etc.

I do wonder if the slop people talk about is from free tiers with very poor prompting or understanding.

It seems that opening a chat with a guide line doc helps a lot. Can give it links to windower standards and tell it what it can and cant do. It also seems that the more you use the AI and it learns and remembers the better it gets at understanding you in context.

Simple truth is AI in some form is here to stay might as well learn to love it.

damn. you were stealing peoples gearswaps bro?

that's insane bro. leet hack man

I fed it the lua that uses Dunna on bard.

It's mostly in the way augments are coded for the game. Most people have the habit of embedding augments per items like JSE Ambuscade cape or Reisenjima augments in line. No worries with that since it's readable from the gearswap file itself.

The problem is the unity or odyssey augment progression system which is handled entirely client side through ex data packets acting as lookups the client decodes. I roughly re-mapped how the client decodes it but that packet data is necessary to know what progression your augment is at. In a non technical way of putting it it's like the game client telling ottoswap "hey this specific nyame piece is at r18, so find the stats associated with that number and path".

IMO it's helpful enough to include since most people looking at gear want that information from the augments since the difference between vanilla odyssey gear and r25 is quite significant.

Hey Dodik, thanks for your thoughtful response here. I love your passion! It looks like you've stumbled upon one of my favorite features here -- the ability to browse other peoples gear. The website provides plenty of ways to do this so you don't need to guess at what other peoples code may be if you're interested.

In terms of those random numbers and letters you've been typing in, it looks like you've maybe misinterpreted the information you discovered. There are share codes which are used to view peoples gearsets like you've discovered which are not the same as their pairing codes. You wont be making any modifications to a players sets without that pairing code.

That's all to say if you were able to brute force a pairing code. If you know some way of doing that at 1.15 * 10^18 possibilities (that's a pretty big number!) I'd definitely be interested to know your method!

But let's say just for science you did break it, or lift one off of someone somehow. You would still need to have that player go and manually execute the command to pull from the relay on their physical computer. The relay santizes input and output from the website so I invite you to try any method you can think of to execute arbitrary code.

Since you seem so passionate here I'll give you the opportunity!

96EHRYZG down from the regular sized pairing code so you don't need wait the approximately 700million years with the rate limiting on the API side to crack the code!

They don't need to crack the code or guess it. There's more value in going at the server or you. You're maintaining a DB with all the codes.
This is why I said "only use this if you trust them". This is only as safe as that DB.

It's also not sanitized; you write full gearswap files based on a transmission from the server. Your addon doesn't execute the code, but the next time the person loads that gearswap file anything in it will be run.

If someone really wanted full remote code execution, all they would have to do is build a small stub dll, store it in the lua file, and write it out then load it. I don't use Windower, but I believe it needs to run as administrator, so that means their lua environment is a few very simple steps from full administrator access. ..There is probably an even simpler way, but again, I don't use Windower.

But it is sanitized, just not on the addon's side. Is that what you mean when you say it's not sanitized? I think Genoxd was also pointing this out earlier. If I were to sanitize it on the addon side that's fine, and I can do that (it would be duplicate of what the relay is doing). If people feel more comfortable and confident seeing that in files they are able to see and edit themselves I can make that change. It's better from an architectural standpoint to do it via the server though, updates don't require users to re-download a new version of the addon every time there are changes.

I think I understand what you may be tacitly saying -- but let me restate to be clear so I don't misrepresent anything you're saying.

You're saying that while any pairing code is public, it may be used to somehow access the server the DB is living on? So basically a user with malicious intent (we'll call him dk) could use a pairing code to gain access to the DB which he uses to gain access to all the pairing codes?

The reason I'm confused is because it sounds the same as trying to use a bearer token or something to gain access to a server.

Or do I not understand? I might not be understanding I'm sorry.

@twochix, What do you mean by sanitized here in this context? like what exactly did you do?

API will respond 422 to anything that isn't relevant to gearsets.
Anything like os.execute os.remove io.popen io.open or os related. dynamic code eval via loadstring loadfile dofile or load or JIT via ffi. any type of permutations for writing this in lua like os["execute"] etc. Anything that hints at passing compiled bytecode gets bounced. various requires for libraries loaded, environment tampering etc.

it doesn't even make it to the API.

But I could just bypass all of this completely and probably send a shape via json for the sets and edits along with crud operations for what to add, whitelisting by res file item names in en or enl (or ja for that case) and probably just avoid this altogether.

Yes. The user does not have any control or ability to see what the server is sending. I'm not saying you would do so, but there's nothing stopping you from writing a malicious dll (myhelper.dll with a luaopen_myhelper function export). Take the binary content of the dll, embed it as a string in a lua file.

Server sends the lua file, it gets written as a GS. Client loads GS, lua file writes string back out as a dll and loads it with require. The user is placing total trust in you not to use this incredibly simple mechanism to gain complete access to their PC.

It may not ever be compromised in practice. However, that sort of design should still be avoided. It's effectively a back door, even if it wasn't designed that way. Use of your project shouldn't require handing you the keys to someone's computer.

Beyond that, your claims of server-side security are all just claims until audited. I'm more practical about it than other AI-skeptics, but it's a reality that AI-written code is rarely audited to the degree it should be. Vibe and hobby projects multiply that.

No, not at all. I'm saying for all I know you've secured your account with password123 and all that's preventing me from accessing the DB is trying password123. The server is closed source from what I can tell. No one has audited it, we have no idea what you did or didn't do.
For all we know this is running on a raspberry pi and fully exposed to the internet.

All I pointed out is that client side there is a potential RCE. If you're preventing that server side, cool. It should likely be done client side too since if your password is somehow password123 and someone breaks into the account or DB then there is no protection for the end user.
Hell what if you go crazy and rage after this wonderful thread that I'm sure you're loving and decide to RCE everyone yourself ;p

This is why I keep saying that this basically boils down to if people trust you or not.

For what it's worth, I think it's a cool idea I just wouldn't personally use the remote features. I'd rather an export feature get integrated into bgwiki/ffxiah so people can easily just copy/paste sets

so a stock lua sanitizer? or did you add windower/gearswap specific provisions to it?

in windower we dont need os.execute to run a command, we dont need io.open to open a file. and in gearswap we dont need loadstring loadfile dofile to load and execute a lua file.

Ah yes! You're absolutely right about that if I had nefarious intent I would be able to do that. In that sense the addon's sanitization of the payload would make sense. I'm happy to update that.

As far as auditing, I'm not sure if you care enough to want to take a look. If you're willing I will think of a way to share what I have with you? Definitely open to any suggestions you have around hardening as well as how to potentially get away from the pitfall you scoped out.

Alternatively I just just drop functionality into the website to upload your gearsets directly for those who do have concerns about this -- the export options already exist so it's simple enough to do. Don't even need to use the addon at all.

Haha no worries, I'm pretty familiar with the process of being roasted in code review, there's nothing that's going to affect me so dramatically that it will result in that. I think, to the contrary, most people are being quite productive and offering good suggestions and feedback for how security can be enhanced. Most people.

Offer stands to you as well, I'm happy to drop into details about what the architecture is as well as the hosting setup -- DM me if you'd like we can hop in disc and I can show you!

Would you like me to add the ability to drop in the lua files so you can avoid using the addon? You'd be full off it if that's the case I think. You wouldn't even need to communicate with the API (although you may want to for some of the discovery related stuff and suggestions). Let me know!

It exists mostly in relation to Lua, with some scrubbing around _G which I believe is gearswap specific.

Can you help me understand what you mean when you say "In windower we don't need..." is that like an attacker could piggyback off of windower.send_command to have windower execute the same commands? If that's what you mean I don't think that's too difficult to scrub out either since I have the before and after state of the file. But generally better I think would just be to avoid this all together. Have the addon send up the files to edit as they exist then anything that hits the API at that point is directions for how to edit, not what to edit. Then the server handles all edits directly

This seems to be the safest option. Why does this tool *need* an add-on companion at all? It's a minor convenience with a lot of risk. Let users upload a file when they want to tinker and then be done with it.

_G is a lua thing, it is the table that holds all global variables and functions.once you are in a lua file that is being executed you have access to all the libraries and API that windower has to offer and we offer many ways to skin a cait.
Those are all windower specific things that a generic tool won't recognize as issues. send_command being one example, and general code obfuscation can make it easy to avoid simple term blacklists, lua having a long and storied history of such tools thanks to roblox.

This is also one of my big problems with AI. It let's you do something so fast that you don't ask the question: "Why am I even doing this?"

Just feed this thread to Fable and let it fix it lol

I'm going to make some changes based on this feedback. Thank you

Besides all the back and forth, I'll leave out my personal feelings about using vibecoding and AI usage in my professional field.

And maybe I just don't get the whole idea of this "addon" but from a quick glance, it seems just to be a webpage to display your sets? Could easily just been a local thing, included instructions to start this react/vue application without having to submit data over the internet? I dunno, just seems overengineered if that's all it does.