From e3d78dc4dc3827a1405b4104359af194d73fbcdd Mon Sep 17 00:00:00 2001 From: tintinhamans <5984296+tintinhamans@users.noreply.github.com> Date: Fri, 7 Aug 2026 19:59:27 +0200 Subject: [PATCH] Redact RNG seed values from HTTP response for security Signed-off-by: tintinhamans <5984296+tintinhamans@users.noreply.github.com> --- .../GameNetwork/GeneralsOnline/HTTP/HTTPRequest.cpp | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/GeneralsMD/Code/GameEngine/Source/GameNetwork/GeneralsOnline/HTTP/HTTPRequest.cpp b/GeneralsMD/Code/GameEngine/Source/GameNetwork/GeneralsOnline/HTTP/HTTPRequest.cpp index e1b72d1b886..b7646874d53 100644 --- a/GeneralsMD/Code/GameEngine/Source/GameNetwork/GeneralsOnline/HTTP/HTTPRequest.cpp +++ b/GeneralsMD/Code/GameEngine/Source/GameNetwork/GeneralsOnline/HTTP/HTTPRequest.cpp @@ -208,6 +208,18 @@ void HTTPRequest::Threaded_SetComplete(CURLcode result) // if we got an error, set the response code to 0 #if !_DEBUG + static const std::string strSeedKey = "\"RNGSeed\":"; + for (size_t seedPos = strResponse.find(strSeedKey); seedPos != std::string::npos; seedPos = strResponse.find(strSeedKey, seedPos)) + { + size_t valueStart = seedPos + strSeedKey.length(); + size_t valueEnd = strResponse.find_first_of(",}", valueStart); + if (valueEnd == std::string::npos) + break; + + strResponse.replace(valueStart, valueEnd - valueStart, ""); + seedPos = valueStart; + } + std::transform(strResponse.begin(), strResponse.end(), strResponse.begin(), [](unsigned char c) { return std::tolower(c); }); if (strResponse.find("token") != std::string::npos)