Adding new cards with Groovy

[melvin]

"Already taken" means submitted to firemind. After submission it will be integrated into the source by one of the devs, which may take some time as it is a manual step. The file is currently integrated, in this revision https://code.google.com/p/magarena/sour ... 8ce66cd0ee

[mike]

At https://www.firemind.ch/status you can see all the submitted cards. PalladiaMors submitted Wall of Junk yesterday.

[hong yie]

Accidently submitted empty script
Mike can help with this? maybe a validation check to prevent empty script.

magma_jet.txt

Code: Select all

name=Magma Jet
image=http://mtgimage.com/card/magma%20jet.jpg
value=3.697
rarity=U
type=Instant
cost={1}{R}
effect=SN deals 2 damage to target creature or player.~Scry 2.
removal=2
timing=removal
oracle=SN deals 2 damage to target creature or player. Scry 2.


[melvin]

Accidently submitted empty script
Mike can help with this? maybe a validation check to prevent empty script.

Second that. Doesn't happen much, but it does mess up the merge script which automatically removes submissions from scripts_missing.

magma_jet.txt

It doesn't load as scry N where N > 1 is not supported. Recommended to try using the card in the game to check that it works properly.

[mike]

I'll see what I can do. If I add a validation what do you guys think of checking for certain keywords or the like?

[hong yie]

It doesn't load as scry N where N > 1 is not supported. Recommended to try using the card in the game to check that it works properly.

sorry, didn't notice. i found scry 1, i thought it works.

[melvin]

I'll see what I can do. If I add a validation what do you guys think of checking for certain keywords or the like?

Now that I think about it, it is actually quite weird to have an empty script since firemind fills in the template for your automatically.

I think the most accurate way to validate is to use the version of Magarena on firemind as the validator. Just chuck the card script and groovy script into the scripts folder and try to load an AI game with that card as the only card in the deck. That is what I do when I merge cards from firemind. The trick is to run DeckStrCal with --repeat 0 so that no games are actually played just the card loading is performed. The program will crash if any card fail to load. It will be really nice if the crash.log can be shown to the user when this happens.

Though sometimes scripters are using features from tip which are not in the last release, so it will fail the validation. In that case, the site can show a warning like "Your submission fails to load in version X.XX, this may happen if you are using features from the development version. Do you want to submit anyway?"

[mike]

Now that I think about it, it is actually quite weird to have an empty script since firemind fills in the template for your automatically.

The script is loaded via ajax when a card name is selected from the autocomplete textbox, it is quite possible that the request fails if java script is disabled or for some reason not working. If the user copy&pastes the card name in there it might also lead to the card script not being loaded.

I think the most accurate way to validate is to use the version of Magarena on firemind as the validator. Just chuck the card script and groovy script into the scripts folder and try to load an AI game with that card as the only card in the deck. That is what I do when I merge cards from firemind. The trick is to run DeckStrCal with --repeat 0 so that no games are actually played just the card loading is performed. The program will crash if any card fail to load. It will be really nice if the crash.log can be shown to the user when this happens.

Though sometimes scripters are using features from tip which are not in the last release, so it will fail the validation. In that case, the site can show a warning like "Your submission fails to load in version X.XX, this may happen if you are using features from the development version. Do you want to submit anyway?"

I agree this is the most user friendly and fail-safe solution. It's also rather difficult to implement.

I do like a challenge though so I'll see if I can make time for it. This would also go hand in hand with the ability to submit updates to existing card scripts.

[hong yie]

the problem i had so far is with the lower box, the groovy script. the auto complete box works fine so far. sometime when i click the name of card the auto complete triggers then submit... don't have chance to copy fill in the groovy script. that's how i had my accidents.

[mike]

That's strange. I added this to the issue tracker.

Are you clicking with a mouse or pressing enter when this happens?

[hong yie]

That's strange. I added this to the issue tracker.

Are you clicking with a mouse or pressing enter when this happens?

i'll try to explain chronologically:
1 type partial card name in the combo box.
2 when the auto complete show card name choices. i choose with keyboard by up-down arrow key.
3 hit Enter / Return button, then....
4 the first script box is always auto-complete, showing card name, picture file, casting cost, power toughness...
5 But i miss the groovy box, cause these data already being sent to firemind.ch, without clicking the submit button.
6 second attempt will show "Already been taken"

this error usually happened when i repeat step 2. the first time seemed always fine. i correct my first statement "when i click the card name...". i didn't click, i choose with up-down arrow from keyboard.

[mike]

Ok, this makes a lot more sense now. I can reproduce the problem but only if I hit enter twice. Obviously this can happen easily and there should be something preventing a half-finished script from being submitted. I'll see what I can do about that.

Also, the new submission system will allow you to update an already submitted script.

[mike]

I just updated my clone of magarena at https://code.google.com/r/projectfiremi ... wdsourcing

It is now capable of checking card scripts as part of a duel and report the failure message.

What worries me though is the possibility of people being able to execute arbitrary code through the groovy scripts. Is this in any way contained by magarena?

[melvin]

What worries me though is the possibility of people being able to execute arbitrary code through the groovy scripts. Is this in any way contained by magarena?

No, we run groovy script with the same privileges as the compiled java code. Suggest limit the running of untrusted groovy scripts to be on the server where proper sandboxing can be enforced by the OS.

[mike]

Even if I manage to sandbox the OS well enough to protect from all possible exploits to the system (which is impossible if we're honest) it would still be very easy to get access to the api key that is already loaded within the JVM.

I can't think of a solution that quells my security concerns apart from just not testing scripts that include groovy code. I realize this sucks because they are the ones that profit most from automated testing but until I find a solution for this (and I'm not very optimistic that I will any time soon) it is the only sensible way to go.