Open
Description
CustomForm currently accepts client submitted data without any validation
https://github.com/dresnite/easyui/blob/pm5/src/EasyUI/variant/CustomForm.php#L69
Because PocketMine-MP does not enforce type or value checks on $data, a malicious client can submit unexpected data structures or values. This may lead to unhandled exceptions or server crashes.
Metadata
Metadata
Assignees
Labels
No labels