Summary
Game server has partial protection but still vulnerable to crash if this.room.details is defined but usernames is undefined.
Affected Code
server-game/src/client.js:63
if (this?.room?.details?.usernames && this.room.details.usernames.includes(this.username)) {
// Safe check on left side, but if usernames becomes null later, includes() crashes
Vulnerability
Race condition if details is set but usernames becomes null between the check.
Impact
- Low probability but possible crash
- Denial of service
Recommended Fix
Use consistent optional chaining:
if (this.room?.details?.usernames?.includes(this.username)) {
References