fix: improve setDisplayName security & optimize (#1919)

skyrim-multiplayer · Apr 14, 2024 · 3f6de86 · 3f6de86
1 parent 3d90a87
commit 3f6de86
Show file tree

Hide file tree

Showing 6 changed files with 15 additions and 13 deletions.
diff --git a/skymp5-client/src/services/services/remoteServer.ts b/skymp5-client/src/services/services/remoteServer.ts
@@ -310,11 +310,8 @@ export class RemoteServer extends ClientListener {
 
               const replaceValue = refr.getBaseObject()?.getName();
 
-              if (replaceValue !== undefined && replaceValue !== "%original_name%") {
-                // SP doesn't support String.replaceAll because Chakracore doesn't
-                while (displayName.includes("%original_name%")) {
-                  displayName = displayName.replace("%original_name%", replaceValue);
-                }
+              if (replaceValue !== undefined) {
+                displayName = displayName.replace(/%original_name%/g, replaceValue);
               }
               else {
                 logError(this, "Couldn't get a replaceValue for SetDisplayName, refr.getFormID() was", refr.getFormID().toString(16));

diff --git a/skymp5-client/src/services/services/spSnippetService.ts b/skymp5-client/src/services/services/spSnippetService.ts
@@ -62,11 +62,8 @@ export class SpSnippetService extends ClientListener {
 
                     const replaceValue = self?.getBaseObject()?.getName();
 
-                    if (replaceValue !== undefined && replaceValue !== "%original_name%") {
-                        // SP doesn't support String.replaceAll because Chakracore doesn't
-                        while (newName.includes("%original_name%")) {
-                            newName = newName.replace("%original_name%", replaceValue);
-                        }
+                    if (replaceValue !== undefined) {
+                        newName = newName.replace(/%original_name%/g, replaceValue);
                         snippet.arguments[0] = newName;
                     }
                     else {

diff --git a/skymp5-server/cpp/server_guest_lib/MpObjectReference.cpp b/skymp5-server/cpp/server_guest_lib/MpObjectReference.cpp
@@ -998,7 +998,8 @@ void MpObjectReference::SetNodeScale(const std::string& node, float scale,
   });
 }
 
-void MpObjectReference::SetDisplayName(const std::string& newName)
+void MpObjectReference::SetDisplayName(
+  const std::optional<std::string>& newName)
 {
   EditChangeForm(
     [&](MpChangeForm& changeForm) { changeForm.displayName = newName; });

diff --git a/skymp5-server/cpp/server_guest_lib/MpObjectReference.h b/skymp5-server/cpp/server_guest_lib/MpObjectReference.h
@@ -150,7 +150,7 @@ class MpObjectReference
                          const espm::LookupResult& textureSet,
                          bool firstPerson);
   void SetNodeScale(const std::string& node, float scale, bool firstPerson);
-  void SetDisplayName(const std::string& newName);
+  void SetDisplayName(const std::optional<std::string>& newName);
 
   const std::set<MpObjectReference*>& GetListeners() const;
   const std::set<MpObjectReference*>& GetEmitters() const;

diff --git a/skymp5-server/cpp/server_guest_lib/script_classes/PapyrusObjectReference.cpp b/skymp5-server/cpp/server_guest_lib/script_classes/PapyrusObjectReference.cpp
@@ -856,7 +856,12 @@ VarValue PapyrusObjectReference::SetDisplayName(
       throw std::runtime_error("SetDisplayName requires at least 2 arguments");
     }
     const char* displayName = static_cast<const char*>(arguments[0]);
-    selfRefr->SetDisplayName(displayName);
+
+    if (!strcmp(displayName, kOriginalNameExpression)) {
+      selfRefr->SetDisplayName(std::nullopt);
+    } else {
+      selfRefr->SetDisplayName(displayName);
+    }
 
     bool force = static_cast<bool>(arguments[1]);
     std::ignore = force;

diff --git a/skymp5-server/cpp/server_guest_lib/script_classes/PapyrusObjectReference.h b/skymp5-server/cpp/server_guest_lib/script_classes/PapyrusObjectReference.h
@@ -69,6 +69,8 @@ class PapyrusObjectReference final
   VarValue IsContainerEmpty(VarValue self,
                             const std::vector<VarValue>& arguments);
 
+  static constexpr auto kOriginalNameExpression = R"(%original_name%)";
+
   // %original_name% will be replaced with the original localized name
   // client-side
   VarValue SetDisplayName(VarValue self,