roncli/fusionbot

A Discord bot used by The Observatory to regulate matches.

Hi, I'm roncli, a software developer from Pittsburg, California. I specialize in node.js applications and websites, as well as game and modding development.

Project Contributions

I have made major contributions to a number of open source projects.

Project	Description
dxx-rebirth	Descent-Rebirth and Descent II-Rebirth.
DXX-Retro	A source port of Descent 1 and 2, focused on quality competitive play. Uncompromising commitment to original gameplay (except where the original sucked). Based on the Rebirth project.
olmod	A mod for the game Overload that enhances the multiplayer experience.
quadra	An addictive action puzzle game with single player and multiplayer capabilities (Internet or LAN). This is the fork that maintains a working Windows version.
PyTracker	Website at retro-tracker.game-server.cc. PyTracker is a reverse-engineered version of the DXX Rebirth Tracker, written in python.

Websites

I have designed and created a number of websites.

Project	URL	Status	Description
nnn	n/a	Awaiting Release	The Noita Nemesis Nation, a website for competitors of the Noita mod Noita Nemesis.
tracker.otl.gg	tracker.otl.gg	Released	An Overload game tracker for servers running olmod.
otl-bot	otl.gg	Released	The Discord bot and website used for the Overload Teams League.
roncli.com	roncli.com	Released	The roncli.com website.
six.gg	six.gg	Released	The website and bot for Six Gaming, a community of gamers.
tis.roncli.com	tis.roncli.com	Released	The site that allows users to search old Trax in Space 1 files.

Applications

Desktop applications I've created.

Project	Status	Description
ChatterGrid	Released	An application to easily create and share custom soundboards.
descentDSNclient	In Development	The client portion of the Descent Dedicated Server Network.
HyperdriveToolkit	In Development	A collection of tools designed to empower streamers to easily create advanced content for their streams and better manage their community.
StreamlinkTwitchLoader	Archived	A simple C# desktop application that will load an arbitrary number of Twitch streams into VLC using Streamlink.

Personal Projects

Projects I've made for my own use, but have the source on GitHub.

Project	Status	Description
dcltwitter	Archived	The Twitter bot for the Descent Champions Ladder. Retired in December 2021.
FusionBot	Deprecated	A Discord bot used by The Observatory to regulate matches.
ol-azure-manager	Archived	Manager for roncli's Overload dedicated servers on Azure. Merged into otl.gg.
olmod-stable-binaries	Released	A repository of olmod binary releases, intended for use by servers to automatically update olmod.
obs-webserver	Released	My homemade node.js webserver that I use for streaming.
tracker-log-archive	Released	A monthly archive of logs from the Overload game tracker.

JavaScript Libraries

These libraries are intended for use on the web.

Project	Status	Description
jquery-default-button	Released	A jQuery plugin to allow setting a default element that is sent the click event when the enter key is pushed inside of an element.
spritefont-js	Released	A library that allows you to easily use a sprite sheet of characters as a font.

npm Modules

I have authored several npm modules.

Project	npm Module	Description
descent3console	descent3console	A cross-platform utility for managing a Descent 3 server via remote console implemented in node.js.
descent3launcher	descent3launcher	A cross-platform launcher for Descent 3 dedicated servers implemented in node.js.
descent3mn3tools	descent3mn3tools	A cross-platform Descent 3 mission parser implemented in node.js.
full-text-search-query	full-text-search-query	full-text-search-query is a JavaScript library that converts a user-friendly search term into a valid Microsoft SQL Server full-text-search query.
hot-router	hot-router	A router for Express that lets you setup route classes to easily create routes. You can hot swap the code inside your classes while your application is running.

Personal node.js Modules

I have created some node.js modules that I use for personal projects. These are modules I don't consider to be ground-breaking enough to be public npm modules, but I use them in multiple projects, so it's a good way to reuse the code.

Project	Description
node-application-insights-logger	A simple reusable class that can log to Azure Application Insights.
node-database	A simple reusable class to query a MS SQL Server database.
node-minify	A simple library that provides combination and minification services for JavaScript and CSS files when using Express.
node-redis	A simple library to make redis calls without having to worry about connections and command syntax.

fusionbot's Issues

CVE-2019-1010266 (Medium) detected in lodash-4.17.5.tgz

CVE-2019-1010266 - Medium Severity Vulnerability

Vulnerable Library - lodash-4.17.5.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.5.tgz

Path to dependency file: /tmp/ws-scm/FusionBot/package.json

Path to vulnerable library: /tmp/ws-scm/FusionBot/node_modules/lodash/package.json

Dependency Hierarchy:

• twitch-js-1.2.17.tgz (Root Library)
  • ❌ lodash-4.17.5.tgz (Vulnerable Library)

Found in HEAD commit: ba9f514228aca432f05e859d0a2c63d8edc1321f

Vulnerability Details

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

Publish Date: 2019-07-17

URL: CVE-2019-1010266

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010266

Release Date: 2019-07-17

Fix Resolution: 4.17.11

---

Step up your Open Source Security Game with WhiteSource here

Implement `!replacehome`, `!forcehome`, and `!forcereplacehome`

CVE-2019-10744 (High) detected in lodash-4.17.5.tgz

CVE-2019-10744 - High Severity Vulnerability

Vulnerable Library - lodash-4.17.5.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.5.tgz

Path to dependency file: /tmp/ws-scm/FusionBot/package.json

Path to vulnerable library: /tmp/ws-scm/FusionBot/node_modules/lodash/package.json

Dependency Hierarchy:

• twitch-js-1.2.17.tgz (Root Library)
  • ❌ lodash-4.17.5.tgz (Vulnerable Library)

Found in HEAD commit: ba9f514228aca432f05e859d0a2c63d8edc1321f

Vulnerability Details

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-07-26

URL: CVE-2019-10744

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: lodash/lodash@a01e4fa

Release Date: 2019-07-08

Fix Resolution: 4.17.12

---

Step up your Open Source Security Game with WhiteSource here

`!merge` does not update a player properly, requiring a server restart to take

When attempting to merge Skywarp in season 13, I had to stop the server and restart it.

Add banned home level list

CVE-2018-16487 (High) detected in lodash-4.17.5.tgz

CVE-2018-16487 - High Severity Vulnerability

Vulnerable Library - lodash-4.17.5.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.5.tgz

Path to dependency file: /tmp/ws-scm/FusionBot/package.json

Path to vulnerable library: /tmp/ws-scm/FusionBot/node_modules/lodash/package.json

Dependency Hierarchy:

• twitch-js-1.2.17.tgz (Root Library)
  • ❌ lodash-4.17.5.tgz (Vulnerable Library)

Found in HEAD commit: ba9f514228aca432f05e859d0a2c63d8edc1321f

Vulnerability Details

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16487

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16487

Release Date: 2019-02-01

Fix Resolution: 4.17.11

---

Step up your Open Source Security Game with WhiteSource here

Allow for a specialty match prior to the Swiss tournament

Give !startevent a parameter that indicates what type of match to create.

Initial parameters would be:

• anarchy - A free for all, scoring 4 season points for 1st, 3 for 2nd, 2 for 3rd, and 1 for everyone else.
• team - A team game, scoring 4 season points for the winners, and 1 for the losers.

Anarchy games would alternate players by ELO if more than one game is needed. Max of 7 players per game.

Team games would have the top players by ELO as captains, and they would then select their team from the pool of remaining players. Team games are only allowed if there is an even number of players available. Max of 6 players per game.

Once this game is complete, then you would proceed to Round 1 of the Swiss tournament as usual.

Add a Twitch bot to poll for which match to watch

Twitch bot would spit out the list of matches with numbers. Viewers will !vote x to vote for the match. After a minute, the results will be given with hosts making the final choice as to who to watch.

Add roles for the Finals Tournament to show who is invited, accepted, and declined.

Remove map changing restrictions from anything except when events are happening

Disallow `!join` until one hour before the event.

Redo `!standings` for the Finals Tournament

Not quite sure what to do with this as you can't just display a bracket in a Discord message, but we'll try something.

First qualifier of the season sets players' season participation role to the prior season.

This happened with Kaleski in Season 13.

Role ordering for created roles does not work as expected

The DiscordJs methodology for role sorting is clunky and unintuitive. We need to find a consistent way to slot roles into the order they belong.

Remove player cap from Finals Tournament

When underdog wins a Finals Tournament match, the score is in the wrong order in match results

Change Finals Tournament to allow people to `!join` before the event, instead of having people `!accept` or `!deny` in advance

Schedule future events so they don't need to be manually opened

New website at feature parity with roncli.com