Fix leak code via netstream ID enumeration

[James159758]

A client can enumerate the sequential stream IDs (1-1024) through NetStreamWrite and download another player's active stream without receiving its header. This exposes E2 source code and other private payloads.

Bind each stream to the recipients of its original message and reject requests from everyone else before sending chunks or invoking completion callbacks. The change is confined to netstream.lua and preserves the existing API and wire format.

[wrefgtzweve]

Detouring every single net function is not a fix for this??

[Grocel]

looks sus

[blueshank-gh]

Yes, lets detour every net function to solve an issue which occurrence can only happen once in a blue moon.
Claude ogus bogus pocus 5.5 really churning out the free agents isn't it?

[thegrb93]

The issue is net.WriteStream is not given info about the recipients so there's no way for it to know who should get the data. A better solution would be to update the WriteStream api to take recipients. If no recipient specified then current behavior is used, otherwise the stream becomes protected and able to be delete when completed.

[blueshank-gh]

Honestly if need be, I think it would be better in the long run to like rewrite or use a different net streaming system at this point, of course this means a heavy refactor if that route is every looked into, but the pay-off would be way better I think than building on top of the current net stream system, which has been used pretty much everywhere, so you also have to battle that dependency across different addons anyways.

[thegrb93]

The update I mentioned would work without breaking anything, so idk why you suggest rewriting it, lol.

[thegrb93]

I can write the update sometime today.

[blueshank-gh]

The update I mentioned would work without breaking anything, so idk why you suggest rewriting it, lol.

so you also have to battle that dependency across different addons anyways.
if another addon has their own netstream.lua, which many do, it will be likely overwritten, and the functions changed as well.
so at that point, to prevent that and not fight with other addons using the same or outdated versions, might be best to have your own.

• well you could also just localize it to scripts n whatever, idk

[thegrb93]

Yeah sadly all the addons will need the update (I think just wire/starfall/pac3 use it at least). Too bad gmod devs never addressed the need for a file sending protocol. Oh well.