https://nvd.nist.gov/vuln/detail/CVE-2023-34561

readme.md

@@ -40,9 +40,7 @@ _these features are implemented_
 - add more old endpoints + better support for older versions
 - add dailies, events, weekly
 - better way for checking if song is custom (currently `id > 50`)
-- sqlite would make sense for this
-- unscuff difficulties
 - moderation utilities
-- probably make more things bools in the database
 - ip actions
-- better song support
+- better song support
+- return "-1" instead of panicking for stuff

src/endpoints/levels/upload_level.rs

@@ -107,6 +107,11 @@ pub fn upload_level(input: Form<FormUploadLevel>) -> status::Custom<&'static str
         return status::Custom(Status::Ok, "-1")
     }
 
+    // ACE vulnerability check
+    if let Some(_ace_object) = level_objects.iter().find(|obj| obj.item_block_id() < Some(0) || obj.item_block_id() > Some(1100)) {
+        return status::Custom(Status::Ok, "-1")
+    }
+
     // data base 🤣😁
     use crate::models::{Level, NewLevel};
 

src/helpers/levels.rs

@@ -21,6 +21,14 @@ macro_rules! object_prop_bool {
     };
 }
 
+macro_rules! object_prop_int {
+    ($key:expr, $name:ident) => {
+        pub fn $name(&self) -> Option<i32> {
+            self.raw.get($key).and_then(|s| s.parse().ok())
+        }
+    };
+}
+
 #[derive(Clone)]
 pub struct ObjectData {
     raw: HashMap<String, String>
@@ -44,6 +52,7 @@ impl ObjectData {
     }
 
     object_prop_bool!("13", checked);
+    object_prop_int!("80", item_block_id);
 }
 
 pub enum PortalSpeed {

src/template_endpoints/index.rs

@@ -6,7 +6,18 @@ use rand::Rng;
 pub fn index() -> Template {
     let silly_strings: Vec<&str> = vec![
         "the trianges consume",
-        "geomtry das"
+        "geomtry das",
+        "now with no RCE!",
+        "the best gdps",
+        "better than topala",
+        "better than robtop",
+        "slaughterhouse",
+        "deepwoken verse 3",
+        "skibidi toilet",
+        "kagepro",
+        "wowaka is peak music",
+        "you have been warned: dyno jun",
+        "listen to jin"
     ];
 
     let mut rng = rand::thread_rng();