Release #458
Release #458
Conversation
|
Important Review skippedBot user detected. To trigger a single review, invoke the You can disable this status message by setting the Note Other AI code review bot(s) detectedCodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review. Comment |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
This is the final PR Bugbot will review for you during this billing cycle
Your free Bugbot reviews will reset on January 29
Details
You are on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle.
To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.
| * Settings like modsSupport, customChannels, or security-related options are excluded. | ||
| */ | ||
| export const serverSafeSettings: Partial<Record<keyof typeof defaultOptions, true>> = { | ||
| remoteContentNotSameOrigin: true, // allow server to change remote content not same origin policy |
There was a problem hiding this comment.
Bug: Server can override client cross-origin security policy
Adding remoteContentNotSameOrigin to serverSafeSettings allows remote servers to modify the client's cross-origin resource policy via the settings channel. This contradicts the documented intent where "security-related options are excluded" from server-controlled settings. A malicious server could set this to true to enable loading media from any origin, potentially enabling phishing attacks through arbitrary external content displayed in-game.
| }) | ||
| export const serverChangedSettings = proxy({ | ||
| value: new Set<string>() | ||
| }) |
There was a problem hiding this comment.
Bug: Server-changed settings never cleared preventing user persistence
The serverChangedSettings set is populated when a server modifies client settings, but it's never cleared on disconnect. This prevents user-initiated changes to those settings from being persisted to local storage, even after leaving the server. The user's manual changes work in the current session but are lost on page reload, as resetStateAfterDisconnect doesn't reset this tracking state.
Additional Locations (1)
basic hand + inventory after re-login event
|
|
||
| if (skinUrl !== stevePngUrl) { | ||
| this.currentSkinUrls[String(entityId)] = skinUrl | ||
| } |
There was a problem hiding this comment.
Bug: Skin cache not cleared when applying default skin
The currentSkinUrls cache is only updated when applying custom skins, not when applying the default steve skin. When a player's skin changes to steve, the cache retains the previous custom skin URL. If that same custom skin URL is subsequently requested, the cache comparison on line 525 incorrectly indicates the skin is already loaded, causing the update to be skipped even though the entity is currently displaying the steve skin. The cache entry needs to be cleared (e.g., delete this.currentSkinUrls[...]) when applying the steve skin to prevent stale cache entries from causing incorrect skip behavior.
PR was created automatically by the release workflow, hope you release it as soon as possible!
Note
Introduce sky light calculation module and waypoint maxDistance, centralize connection options, and optimize player skin loading while enabling safer server-driven settings.
renderer/viewer/lib/skyLight.tsand usecalculateSkyLightSimpleinworldrendererCommon.getMesherConfig().maxDistancevisibility and option inrenderer/viewer/three/waypoints.ts; pass via custom channel metadata.skin.isCustom, and clear per-entity caches on removal; minororiginalEntityhandling for player.lastConnectOptionstosrc/appStatus.ts; update imports across app.options.customChannelsto'websocket'and auto-enable for ws servers.serverChangedSettingsand expandserverSafeSettings(e.g.,remoteContentNotSameOrigin, rendering/UI prefs).lastConnectOptionsimport.Written by Cursor Bugbot for commit 2d34ac1. This will update automatically on new commits. Configure here.