Skip to content

Fix geyser connection timeout caused by translation expansion - #6579

Open
cranberry3148 wants to merge 7 commits into
GeyserMC:masterfrom
cranberry3148:fix/prevent-translation-amplification
Open

cranberry3148 wants to merge 7 commits into
GeyserMC:masterfrom
cranberry3148:fix/prevent-translation-amplification

Conversation

@cranberry3148

@cranberry3148 cranberry3148 commented Jul 30, 2026 •

Copy link
Copy Markdown

Prevent potential DoS attacks by capping how much a translatable message can expand during rendering. Introduce an amplification calculation and reject overly complex messages.

(Written by Codex, tested by Humans)

@cranberry3148
cranberry3148 marked this pull request as draft July 30, 2026 21:09
@cranberry3148
cranberry3148 marked this pull request as ready for review July 30, 2026 21:35
@onebeastchris

Copy link
Copy Markdown
Member

Hello! Thanks for the PR. Wouldn't this not already be covered by this addition to the flattener?
https://github.com/GeyserMC/Geyser/blob/master/core%2Fsrc%2Fmain%2Fjava%2Forg%2Fgeysermc%2Fgeyser%2Ftranslator%2Ftext%2FMessageTranslator.java#L115

@cranberry3148

Copy link
Copy Markdown
Author

Hi!

The linked nestingLimit line only limits recursion depth and not exponential breadth. Simply lowering that below 13 (which my testing crash item uses) would break legit detailed names, the check in this PR catches excessive expansion before flattening.

@CoasterFreakDE

Copy link
Copy Markdown

Can confirm this fixes the sword crash.

@cranberry3148
cranberry3148 force-pushed the fix/prevent-translation-amplification branch from 71178c4 to 0c54127 Compare August 4, 2026 20:44

@onebeastchris onebeastchris left a comment •

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just a thought - can we move the cap into the complexMapper directly to avoid iterating over the whole component?

@cranberry3148
cranberry3148 force-pushed the fix/prevent-translation-amplification branch from 0c54127 to cc39492 Compare August 22, 2026 22:11
@cranberry3148

Copy link
Copy Markdown
Author

Hey! I removed the recursive pre-scan, moved the cap into complexMapper, and added a regression test for wide, non-amplifying translations.

@cranberry3148 cranberry3148 changed the title Limit translation expansion Fix geyser connection timeout caused by translation expansion Aug 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants