How to report game without input validation?

[salty-horse]

As I'm currently developing a game, I'm trying to learn from other games posted online.

In one of these games, I discovered that the basic playCard function doesn't check on the server-side if the player calling it actually holds the card, which means the player can play a card from "anywhere".

In this situation, should I just report the bug to the game's forums, or go through more discreet channels? With "serious" software, this might be considered a security issue, but since this is just a games platform, I don't know if it matters and what the policy is.

Since I found it in one game, I'm imagining the issue might be widespread, and many published games could be missing these crucial validations to prevent cheating, etc. Is it expected that all published game be coded defensively, or is it kind of a nice-to-have?

One thing I had issue with is that some of the official tutorials (Hearts, for example) are not complete projects, and in addition to missing features (such as a full implementation of passing cards), they're also missing server-side input checks, and only have placeholder comments such as "XXX check rules here". IMO examples should be complete and showcase best practices, rather than leaving chunks of the game as an exercise to the reader.

[robinzig]

My 2p worth - very much not official:

Absolutely these checks should be there to prevent cheating. But realistically the small BGA team can't be expected to check this for every action of every game that makes it to Alpha. Unfortunately this isn't something reviewers will generally check - they'll just playtest the game and make sure the interface works well, without testing to see if it's possible to send a request to the server that results in an illegal move.

I'm not sure how best to report it. If you know who the developer is, and they're active on the forum or in the BGA developer Discord, it might be best to send them a private message there. If not, it's not clear what can be done - you could log a bug, but that isn't particularly public, and if the developer isn't active, is likely to sit for months or years with no action. But I don't see the need to be overly discreet - this isn't a case where serious consequences like stealing of money or identity can result from the vulnerability being widely known, it's just that some sad people could use it to cheat in an online game. And if this were to happen, the player community would be sure to notice something was up and, if BGA investigated it, the flaw in the game code would soon be discovered.

So I'm not sure. Perhaps send a private message to one of the site admins explaining the details of your findings.

[Een]

All input and rules should be validated server side.

If the developer is active, as suggested by robinzig, the best is to report to them directly (you can access their profile from the game page and message them). Otherwise, or if you are unsure how to proceed, please write to studio@boardgamearena.com

[salty-horse]

I got a reply from the developer, thanks.

As for my other comment about the tutoriaIs missing important information, please consider adding it.

I already found the "full" Hearts project by requesting access to it in studio, and fetching it via FTP, but I feel like this process of learning by example should be simpler.

[Een]

As for my other comment about the tutoriaIs missing important information, please consider adding it.

I already found the "full" Hearts project by requesting access to it in studio, and fetching it via FTP, but I feel like this process of learning by example should be simpler.

Everything could certainly be improved, but it's unlikely that we will be able to review studio tutorials at the moment.

That being said, studio documentation including tutorials is a wiki for exactly this reason: so that it can be improved without an admin review. If you find something definitely missing that can improve the learning experience of future developers, please don't hesitate to add it.

Also, the hearts and reversi projects should have been copied readonly to your sftp by default when your studio account was created.

[salty-horse]

Good point. The documentation only mentions the partial github in the section I looked. I will add a note about the production code being available via sftp (It's mentioned at the top of the page, but it wasn't clear to me it's not the same tutorial)

Here's my edit if you wish to review it: https://en.doc.boardgamearena.com/index ... ldid=10359

[Een]

Looks good! Thanks.