Take the 2-minute tour ×
Game Development Stack Exchange is a question and answer site for professional and independent game developers. It's 100% free, no registration required.

I am developing a game in java and plan to embed the Groovy script engine to allow for more robust modding options. This comes at a price, of course. Groovy can access anything java can by default, making it something of a security risk. At the moment, this doesn't worry me all too much, as mods for many other single player games such as minecraft already provide this level of access.

However, while the game does not currently have multiplayer support, I would very much like to change that at some point after the initial release. In this case, I would like to be able to allow servers to supply required mod files directly to the client. Is it safe to allow this sort interaction in any case?

My current plan of implementation for this would be to have the server supply mod files to clients, then have the clients pass the name of the mod to a public server I'd host, receiving back from me the expected hash value of that mod to compare against a locally computed hash of the files received from the client. They'd also be given the public rating and description of the mod, and be prompted from there if they wished to keep the mod or discard it.

Obviously this would still require me hosting a mod validation server, so that mods not on the server would be rejected by default. And I'd likely have to provide the ability to download mods directly from this server for users looking to get these mods in the first place, but the purpose of this is to allow players to easily connect to servers without planning out ahead of time what mods they'd need to download, while also decreasing some of the bandwidth overhead I'd have to deal with by having servers host the files and myself simply serving up short blocks of text and hashes.

In summary: Is this complete overkill? Can I even trust servers to host safe content? Can I trust servers to host safe content without checking up on the files they send? Is this not enough security? Do I need to sandbox groovy, or would I be wasting my time?

share|improve this question

1 Answer 1

up vote 2 down vote accepted

If the game downloads executable code of any fashion, you had better sandbox it completely. Many games don't, and as an ex-security guy, I give all such games an F.

I wouldn't worry about the server validating too much since the user has to make the option to trust any particular server in this instance.

You can get away with not sandboxing your scripts if you make sure you clearly inform users about the dangers of connecting to unknown servers and if you make it easy to opt-out of executing scripts after they've been downloaded (so users can easily check what scripts a server is sending without running them). Also, in this case, use end-to-end encryption (SSL/TLS) to prevent injection of malicious code.

It probably wont' matter in practice, but do you want to be responsible for stolen personal data? If you aren't going to put the user and their security and safety first, do not write networked code, or really any code at all for that matter. Don't be irresponsible just to save on some time and effort. Please.

share|improve this answer
    
Well, this is all about two years out from when I begin implementing it. Hopefully that inspires some confidence I'm not just trying to save time and effort and instead taking this seriously. At any rate, I was mostly trying to get a sense of how secure my plan of implementation was compared to acceptable standards. At any rate, you made a lot of good points. I hadn't yet considered encryption between the host and server, for some reason... About validating server-sent files: wouldn't this at least give the users a warning if the server is trying to provide a corrupt version of a good mod? –  Hawkwing Jul 19 '13 at 14:37
    
You should trust your server, or don't host on them if you don't. –  Sean Middleditch Jul 19 '13 at 15:57
    
I can trust my download server, sure. The question was how to help players decide if they should trust the files sent from the 3rd-party game server they are connecting to, or if that is far too big of a hole to try and patch. –  Hawkwing Jul 19 '13 at 17:04
    
You can't. They either do or they don't. If you can download scripts, it's no different than downloading a .EXE from some random site. Either it's a site operated by people they trust or its not. Sandbox your scripts thoroughly so servers can't do any damage to the users' machines or data. You could build some kind of web of trust or authority, but maintaining that for a small game is going to be problematic, and you need tools then for "researchers" to download all content from a server and inspect it without running it, plus notices if content changes. Just sandbox. –  Sean Middleditch Jul 19 '13 at 17:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.