c1442aff3e
### Summary Players reported an exploit: decipher a treasure map, then run a ClassicUO/Razor organizer agent that pulls the gold out of the chest in small amounts. Each pull spawned more monsters, turning one chest into an unbounded farmable spawn generator. ### Root cause `TreasureMapChest.OnItemLifted` grants a 10% guardian spawn roll per first-time-lifted item, deduplicated by the instance-keyed `_lifted` set. But a partial lift goes through `Mobile.LiftItemDupe`, which re-adds the stack remainder to the chest as a **brand-new item instance** (engine-side `AddItem`, bypassing the `CheckHold` block on refilling). Every subsequent pull lifts an instance the `_lifted` set has never seen, so each one re-rolls the 10% spawn chance: - A level 4 chest holds 4,000 gold → pulled coin by coin, ~400 spawned creatures (plus more from reagent stacks), hands-free, per chest. - Spawns use `guardian: false`, so nothing tracks or caps them. - Legit full-stack looting yields roughly 5–8 bonus spawns per chest for comparison. The code is inherited from RunUO, so descendant shards likely share the hole. ### Fix Mark every item that enters the chest **after the initial fill** as already lifted, via an `OnItemAdded` override gated by a non-serialized `_filled` flag (set at the end of the constructor and in `[AfterDeserialization]`). Ordering makes this exact: `LiftItemDupe` re-adds the remainder *before* the chest's `OnItemLifted` runs, so the lifted original still gets its one legitimate roll while the remainder is pre-marked. This also covers packing items *into* the chest (e.g., merging gold back in to lift it out again) and bounce-backs — anything not part of the original loot can never grant a spawn roll. ### Tests - `PartialLift_MarksSplitRemainderAsLifted` — drives the real `Mobile.Lift` path with a 1-coin pull and asserts the split remainder is marked (failed before the fix). - `ItemAddedAfterFill_IsMarkedLifted` — post-fill additions are marked (failed before the fix). - `OriginalFillLoot_IsNotMarkedLifted` — original loot keeps spawn-roll eligibility. Full `UOContent.Tests` suite: 701 passed.
111 lines
3 KiB
C#
111 lines
3 KiB
C#
using Server;
|
|
using Server.Items;
|
|
using Server.Mobiles;
|
|
using Server.Tests;
|
|
using Xunit;
|
|
|
|
namespace UOContent.Tests;
|
|
|
|
[Collection("Sequential UOContent Tests")]
|
|
public class TreasureMapChestLiftTests
|
|
{
|
|
// Coordinates chosen to avoid overlap with Tracking (1000-4000, 1000-4000) and
|
|
// DetectHidden (1000-2400, 500) test areas.
|
|
|
|
[Fact]
|
|
public void PartialLift_MarksSplitRemainderAsLifted()
|
|
{
|
|
using var rng = new PredictableRandom(10); // RandomDouble() = 0.5, no spawn roll fires
|
|
var map = Map.Felucca;
|
|
var location = new Point3D(5000, 600, 0);
|
|
var player = CreatePlayerMobile(map, location);
|
|
var chest = new TreasureMapChest(1);
|
|
|
|
try
|
|
{
|
|
chest.MoveToWorld(location, map);
|
|
chest.Locked = false;
|
|
|
|
var gold = FindGold(chest, null);
|
|
Assert.NotNull(gold);
|
|
|
|
player.Lift(gold, 1, out var rejected, out _);
|
|
Assert.False(rejected);
|
|
|
|
// The stack split re-adds the remainder as a brand-new item. It must count as
|
|
// already lifted, otherwise every 1-coin pull grants a fresh guardian spawn roll.
|
|
var remainder = FindGold(chest, gold);
|
|
Assert.NotNull(remainder);
|
|
Assert.Contains(remainder, chest.Lifted);
|
|
Assert.Contains(gold, chest.Lifted);
|
|
}
|
|
finally
|
|
{
|
|
player.Holding?.Delete();
|
|
player.Delete();
|
|
chest.Delete();
|
|
}
|
|
}
|
|
|
|
[Fact]
|
|
public void ItemAddedAfterFill_IsMarkedLifted()
|
|
{
|
|
using var rng = new PredictableRandom(10);
|
|
var chest = new TreasureMapChest(1);
|
|
var packed = new Gold(500);
|
|
|
|
try
|
|
{
|
|
// Anything entering the chest after the initial fill (packed-back gold, split
|
|
// remainders, GM drops) was never part of the original loot and must not
|
|
// grant spawn rolls when lifted back out.
|
|
chest.DropItem(packed);
|
|
|
|
Assert.Contains(packed, chest.Lifted);
|
|
}
|
|
finally
|
|
{
|
|
chest.Delete();
|
|
}
|
|
}
|
|
|
|
[Fact]
|
|
public void OriginalFillLoot_IsNotMarkedLifted()
|
|
{
|
|
using var rng = new PredictableRandom(10);
|
|
var chest = new TreasureMapChest(1);
|
|
|
|
try
|
|
{
|
|
// The original loot must stay roll-eligible for its first lift.
|
|
Assert.True(chest.Lifted == null || chest.Lifted.Count == 0);
|
|
}
|
|
finally
|
|
{
|
|
chest.Delete();
|
|
}
|
|
}
|
|
|
|
private static Gold FindGold(TreasureMapChest chest, Gold except)
|
|
{
|
|
var items = chest.Items;
|
|
|
|
for (var i = 0; i < items.Count; i++)
|
|
{
|
|
if (items[i] is Gold gold && gold != except)
|
|
{
|
|
return gold;
|
|
}
|
|
}
|
|
|
|
return null;
|
|
}
|
|
|
|
private static PlayerMobile CreatePlayerMobile(Map map, Point3D location)
|
|
{
|
|
var mobile = new PlayerMobile(World.NewMobile);
|
|
mobile.DefaultMobileInit();
|
|
mobile.MoveToWorld(location, map);
|
|
return mobile;
|
|
}
|
|
}
|