Skip to content

feat(upstream): rebuild on SilvDev Spray_Exploit 2.28 - #34

Closed
Rushaway wants to merge 41 commits into
srcdslab:masterfrom
Rushaway:feat/rebuild-upstream-2.28
Closed

feat(upstream): rebuild on SilvDev Spray_Exploit 2.28#34
Rushaway wants to merge 41 commits into
srcdslab:masterfrom
Rushaway:feat/rebuild-upstream-2.28

Conversation

@Rushaway

@Rushaway Rushaway commented Sep 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Summary

Rebuilds FixSprayExploit.sp and spray_exploit.inc on the latest upstream release, SilvDev/Spray_Exploit@ade947b (2.28, 12-Jun-2026), and reapplies only the srcdslab-specific changes on top. After this PR, a diff against upstream shows only our own changes.

Upstream changes pulled in

  • 2.27 (04-Jan-2026): Silvers' version of the file size check, written by null138. It replaces our own 2.28 implementation from feat(core): Patch latest sprays exploit #24.
    • Invalid size is reported as index = -2 in OnSprayExploit.
    • sm_spray_test console output now also prints Invalid size: ....
  • 2.28 (12-Jun-2026): fixes jingles being blocked. A jingle that has not been checked yet is now validated on demand (FileCheck()) instead of being dropped.
  • spray_exploit.inc: upstream's improved forward documentation.
  • Changelog, copyright and formatting now match upstream.

srcdslab changes kept

  • #include <spray_exploit> is enabled; upstream has it commented out.
  • g_bIsVTFExploit: once a client is flagged (in PlayerDecal or FileCheck), we stop sending the blocked decal back to them in ReqTempEnt. The flag is reset on connect and disconnect.

Dropped from our old 2.28 (#24)

  • Extended g_iVal (offsets 36-62 as wildcards). Upstream uses MAX_SIZE 64, and ValFile() only compares offsets < 27, so detection is unchanged.
  • Our own size-mismatch branch (SIZE_TOLERANCE, Seek / Position), replaced by upstream's equivalent 5% check. That check only applies when both sizes are above 1000 bytes.

⚠️ API note

For a size mismatch, OnSprayExploit(client, -2, value) now passes value = -2, matching upstream. Our old version passed the actual file size here. Plugins that read value for index -2 need to be checked.

Test plan

  • CI compiles with SM 1.12
  • A valid spray is still displayed
  • A valid jingle plays (upstream 2.28 fix)
  • Exploit / bad-size sprays are blocked, logged and the forward fires

Closes #16

🤖 Generated with Claude Code

maximee-leroyy and others added 30 commits August 16, 2021 15:41
@maximee-leroyy
Initial commit
18228cd
@maximee-leroyy
Update to 2.7
9bba0d5
@Rushaway @maximee-leroyy
Update to 2.10
1d9f097
Maxime @maximee-leroyy
Update addons/sourcemod/scripting/FixSprayExploit.sp
a21988e
@Rushaway @maximee-leroyy
Update to 2.13
3735c8e
@Rushaway
PrintToServer only if Log Cvar is set to 0 (srcdslab#1)
d67014a 
* PrintToServer only if Log Cvar is set to 0

* Fix small mistake from author
@maximee-leroyy
feat: github ci
9102f78
@Rushaway
feat: bump to 2.18 (srcdslab#2)
21b381a 
2.18 (24-Dec-2022)
	- Fixed moving sprays causing a script execution timed out error. Thanks to ".Rushaway" for reporting.
2.17 (08-Oct-2022)
	- Fixed command "sm_spray_test" getting stuck processing under certain conditions.
	- Re-wrote the recursive directory function to avoid several bugs under several conditions.
	- Now only moves sprays (.dat or .dat.ztmp) and not other files to the "backup_sprays" folder.
	- Now deletes empty directories on plugin start after moving sprays to the "backup_sprays" folder.
2.16 (30-Sep-2022)
	- Fixed not moving all sprays on disconnect.
	- Fixed client not in game errors when renaming sprays.
	- Now moves "dat.ztmp" spray files to backup folder.
2.15 (22-Sep-2022)
	- Fixed not deleting the old backup if the names match.
2.14 (22-Sep-2022)
	- Added cvar "spray_exploit_fixer_msg" to control if messages should print to the server console. Requested by ".Rushaway".
	- Plugin now moves all sprays to the "download/backup_sprays" folder on plugin start and client disconnect.
	- Removed saving checked and blocked sprays to file. All sprays will be checked.
@Rushaway
feat: bump to 2.20 (srcdslab#3)
74feef8 
2.20 (20-Jan-2023)
	- Now logs if a Steam ID is unverified.
	- Now prevents log spamming duplicate entries.
	- Fixed checking bots for sprays.
	- Thanks to ".Rushaway" for reporting and help testing.
2.19 (07-Jan-2023)
	- Fixed processing getting stuck. Thanks to "SuperConker" for reporting and help testing.
	- Fixed invalid handle errors. Thanks to "nikooo777" for reporting.
@Rushaway
Ffeat: bump to 2.22 (srcdslab#4)
c4dd324
@Rushaway
fix: github ci dependencies (srcdslab#5)
61c4703
@Rushaway
feat: cvars spray_exploit_fixer_punish_client and spray_exploit_fixer…
8d535c8 
…_bantime (srcdslab#6)
@Rushaway
chore: bump to 2.24 (srcdslab#7)
a904cc2
@Rushaway
fix: memory leak (srcdslab#8)
3678a3f
@Rushaway
chore(ci): enable dependabot (srcdslab#9)
4184d61
@dependabot
chore(deps): bump actions/upload-artifact from 3 to 4 (srcdslab#10)
d56de60 
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 3 to 4.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v3...v4)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump dev-drprasad/delete-tag-and-release (srcdslab#11)
525283a 
Bumps [dev-drprasad/delete-tag-and-release](https://github.com/dev-drprasad/delete-tag-and-release) from 0.2.1 to 1.0.1.
- [Release notes](https://github.com/dev-drprasad/delete-tag-and-release/releases)
- [Commits](dev-drprasad/delete-tag-and-release@v0.2.1...v1.0.1)

---
updated-dependencies:
- dependency-name: dev-drprasad/delete-tag-and-release
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump actions/download-artifact from 3 to 4 (srcdslab#12)
0e0ae7c 
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 3 to 4.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@v3...v4)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump actions/checkout from 3 to 4 (srcdslab#13)
3ccb68e 
Bumps [actions/checkout](https://github.com/actions/checkout) from 3 to 4.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v3...v4)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump dev-drprasad/delete-tag-and-release from 1.0.1 to 1…
7e13119 
….1 (srcdslab#14)

Bumps [dev-drprasad/delete-tag-and-release](https://github.com/dev-drprasad/delete-tag-and-release) from 1.0.1 to 1.1.
- [Release notes](https://github.com/dev-drprasad/delete-tag-and-release/releases)
- [Commits](dev-drprasad/delete-tag-and-release@v1.0.1...v1.1)

---
updated-dependencies:
- dependency-name: dev-drprasad/delete-tag-and-release
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@Rushaway
feat(upstream): recent exploit fix
086510f 
https://github.com/SilvDev/Spray_Exploit/blob/main/scripting/spray_exploit_fixer.sp
@Rushaway
feat(2.26): API, Refactoring (srcdslab#17)
d6091d7
@dependabot
chore(deps): bump actions/checkout from 4 to 5 (srcdslab#18)
5099132 
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 5.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v5)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@Rushaway
chore(ci): update to ubuntu 24.04
acc9b3b
@dependabot
chore(deps): bump actions/download-artifact from 4 to 5 (srcdslab#19)
06725fe 
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4 to 5.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@v4...v5)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@Rushaway
fix(ci): release file path
42ce18e
@Rushaway
chore(ci): coding agent instructions (srcdslab#20)
f7a914c 
Co-authored-by: Rushaway <11679883+Rushaway@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
@dependabot
chore(deps): bump actions/download-artifact from 5 to 6 (srcdslab#22)
d1fa8ab 
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump actions/upload-artifact from 4 to 5 (srcdslab#21)
a234e8e 
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump actions/checkout from 5 to 6 (srcdslab#23)
949026c 
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Rushaway and others added 11 commits December 4, 2025 16:46
@Rushaway
feat(core): patch latest sprays exploit (srcdslab#24)
0462439
@dependabot
chore(deps): bump actions/upload-artifact from 5 to 6 (srcdslab#25)
dafc11d 
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump actions/download-artifact from 6 to 7 (srcdslab#26)
41db8bc 
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump actions/upload-artifact from 6 to 7 (srcdslab#28)
e8ad3db 
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump actions/download-artifact from 7 to 8 (srcdslab#27)
33089d8 
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@Rushaway
chore(ci): bump SM to 1.12 (srcdslab#29)
408e5ba
@dependabot
chore(deps): bump actions/checkout from 6 to 7 (srcdslab#30)
b785bc6 
Signed-off-by: dependabot[bot] <support@github.com>
@Rushaway
chore(ci): replace SourceKnight with setup-sp (srcdslab#31)
3b4b33f
@Rushaway
chore(ci): remove deprecated delete-tag-and-release action (srcdslab#32)
3be8f55
@Rushaway
ci: add Dependabot auto-merge workflow (srcdslab#33)
ace360d
@Rushaway @claude
feat(upstream): rebuild on SilvDev Spray_Exploit 2.28
da70764 
Sync the plugin with SilvDev/Spray_Exploit@ade947b (2.28, 12-Jun-2026):
- 2.27: upstream implementation of the file size check (index -2)
- 2.28: fix jingles being blocked (validate the jingle file on demand)

Keep srcdslab specific changes on top:
- include <spray_exploit> enabled
- g_bIsVTFExploit: do not echo blocked decals back to flagged clients

Closes srcdslab#16

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Copilot AI balanced review requested due to automatic review settings September 29, 2026 18:41
Copilot AI reviewed Sep 29, 2026

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@Rushaway Rushaway closed this Sep 29, 2026
@Rushaway
Rushaway deleted the feat/rebuild-upstream-2.28 branch September 29, 2026 21:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Rebuild the repo based on upstream

4 participants

@Rushaway @maximee-leroyy