FieldValidator: reject NaN/Infinity in client-supplied floats

Covers Position, Velocity, RotationY, Movement/Slide blends, and
optional HeadYaw/HeadPitch across input/emote/teleport messages.
Guards the snapshot ring from poisoned values that break observer
interpolation and inflate IsSameState diffs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: mikhail-dcl

docs/hardening.md

@@ -280,9 +280,18 @@ that fall outside the encoder's grid produce garbage global positions downstream
 ### Defense
 
 `src/DCLPulse/Messaging/Hardening/FieldValidator.cs` — one class, three per-message methods
-(`ValidatePlayerStateInput`, `ValidateEmoteStart`, `ValidateTeleport`). Parcel bounds come
-from the existing `ParcelEncoderOptions` (`ParcelEncoder.IsValidIndex`). On any violation the
-peer is disconnected with a message-type-specific `DisconnectReason`.
+(`ValidatePlayerStateInput`, `ValidateEmoteStart`, `ValidateTeleport`). Checks performed:
+
+- Parcel-index bounds (delegated to `ParcelEncoder.IsValidIndex`).
+- String length caps (`EmoteId`, `Realm`).
+- `EmoteStart.DurationMs` upper bound.
+- **Finiteness** (`float.IsFinite`) on every client-supplied float: `Position`, `Velocity`,
+  `RotationY`, `MovementBlend`, `SlideBlend`, optional `HeadYaw`/`HeadPitch`,
+  `TeleportRequest.Position`. Rejects NaN and ±Infinity. Optional fields (head yaw/pitch)
+  are checked only when the proto's `Has*` flag is set.
+- Null-guard on `Position`/`Velocity` proto sub-messages to prevent NRE on malformed input.
+
+On any violation the peer is disconnected with a message-type-specific `DisconnectReason`.
 
 ### Config
 

src/DCLPulse/Messaging/Hardening/FieldValidator.cs

@@ -4,6 +4,7 @@
 using Pulse.Metrics;
 using Pulse.Peers;
 using Pulse.Transport;
+using Vector3Proto = Decentraland.Common.Vector3;
 
 namespace Pulse.Messaging.Hardening;
 
@@ -30,6 +31,9 @@ public bool ValidatePlayerStateInput(PeerIndex from, PeerState state, PlayerStat
         if (!IsValidParcel(input.State.ParcelIndex))
             return Reject(from, state, DisconnectReason.INVALID_INPUT_FIELD);
 
+        if (!IsValidPlayerStateFloats(input.State))
+            return Reject(from, state, DisconnectReason.INVALID_INPUT_FIELD);
+
         return true;
     }
 
@@ -44,6 +48,9 @@ public bool ValidateEmoteStart(PeerIndex from, PeerState state, EmoteStart emote
         if (!IsValidParcel(emote.PlayerState.ParcelIndex))
             return Reject(from, state, DisconnectReason.INVALID_EMOTE_FIELD);
 
+        if (!IsValidPlayerStateFloats(emote.PlayerState))
+            return Reject(from, state, DisconnectReason.INVALID_EMOTE_FIELD);
+
         return true;
     }
 
@@ -58,8 +65,33 @@ public bool ValidateTeleport(PeerIndex from, PeerState state, TeleportRequest re
         if (!IsValidParcel(request.ParcelIndex))
             return Reject(from, state, DisconnectReason.INVALID_TELEPORT_FIELD);
 
+        if (!IsFinite(request.Position))
+            return Reject(from, state, DisconnectReason.INVALID_TELEPORT_FIELD);
+
         return true;
     }
 
     private bool IsValidParcel(int index) => parcelEncoder.IsValidIndex(index);
+
+    /// <summary>
+    ///     Rejects NaN/±Infinity on every client-supplied float in <see cref="PlayerState" />.
+    ///     These values would propagate into the snapshot ring and fan out to observers, where
+    ///     NaN breaks interpolation and inflates the <c>IsSameState</c> diff check (NaN != NaN
+    ///     under IEEE). Also rejects malformed proto with unset Position/Velocity, which would
+    ///     otherwise NRE in the handler. Optional fields (head yaw/pitch) are checked only
+    ///     when present.
+    /// </summary>
+    private static bool IsValidPlayerStateFloats(PlayerState s) =>
+        s.Position is not null
+     && s.Velocity is not null
+     && IsFinite(s.Position)
+     && IsFinite(s.Velocity)
+     && float.IsFinite(s.RotationY)
+     && float.IsFinite(s.MovementBlend)
+     && float.IsFinite(s.SlideBlend)
+     && (!s.HasHeadYaw || float.IsFinite(s.HeadYaw))
+     && (!s.HasHeadPitch || float.IsFinite(s.HeadPitch));
+
+    private static bool IsFinite(Vector3Proto? v) =>
+        v is not null && float.IsFinite(v.X) && float.IsFinite(v.Y) && float.IsFinite(v.Z);
 }

src/DCLPulseTests/Hardening/FieldValidatorTests.cs

@@ -34,7 +34,13 @@ private FieldValidator Create(int maxEmoteIdLength = 64, int maxRealmLength = 12
 
     private static PeerState NewState() => new (PeerConnectionState.AUTHENTICATED);
 
-    private static PlayerState ValidPlayerState() => new () { ParcelIndex = 100 };
+    private static PlayerState ValidPlayerState() =>
+        new ()
+        {
+            ParcelIndex = 100,
+            Position = new Vector3(),
+            Velocity = new Vector3(),
+        };
 
     private static EmoteStart ValidEmoteStart(string emoteId = "wave", uint? durationMs = 3000) =>
         new ()
@@ -183,6 +189,107 @@ public void OversizedRealm_Rejects()
         transport.Received(1).Disconnect(PEER, DisconnectReason.INVALID_TELEPORT_FIELD);
     }
 
+    // ── Numeric finiteness (NaN/Inf) ─────────────────────────────────
+
+    private static PlayerStateInput InputWith(Action<PlayerState> mutate)
+    {
+        PlayerState s = ValidPlayerState();
+        mutate(s);
+        return new PlayerStateInput { State = s };
+    }
+
+    [Test]
+    public void NaNPosition_InInput_Rejects()
+    {
+        FieldValidator v = Create();
+        PlayerStateInput msg = InputWith(s => s.Position = new Vector3 { X = float.NaN, Y = 0, Z = 0 });
+
+        Assert.That(v.ValidatePlayerStateInput(PEER, NewState(), msg), Is.False);
+        transport.Received(1).Disconnect(PEER, DisconnectReason.INVALID_INPUT_FIELD);
+    }
+
+    [Test]
+    public void InfinityVelocity_InInput_Rejects()
+    {
+        FieldValidator v = Create();
+        PlayerStateInput msg = InputWith(s => s.Velocity = new Vector3 { X = 0, Y = float.PositiveInfinity, Z = 0 });
+
+        Assert.That(v.ValidatePlayerStateInput(PEER, NewState(), msg), Is.False);
+        transport.Received(1).Disconnect(PEER, DisconnectReason.INVALID_INPUT_FIELD);
+    }
+
+    [Test]
+    public void NaNRotationY_InInput_Rejects()
+    {
+        FieldValidator v = Create();
+        PlayerStateInput msg = InputWith(s => s.RotationY = float.NaN);
+
+        Assert.That(v.ValidatePlayerStateInput(PEER, NewState(), msg), Is.False);
+    }
+
+    [Test]
+    public void NaNMovementBlend_InInput_Rejects()
+    {
+        FieldValidator v = Create();
+        PlayerStateInput msg = InputWith(s => s.MovementBlend = float.NaN);
+
+        Assert.That(v.ValidatePlayerStateInput(PEER, NewState(), msg), Is.False);
+    }
+
+    [Test]
+    public void NaNHeadYaw_InInput_Rejects()
+    {
+        FieldValidator v = Create();
+        PlayerStateInput msg = InputWith(s => s.HeadYaw = float.NaN);
+
+        Assert.That(v.ValidatePlayerStateInput(PEER, NewState(), msg), Is.False);
+    }
+
+    [Test]
+    public void UnsetHeadYaw_IsIgnored()
+    {
+        // HasHeadYaw is false by default; finiteness check should skip it regardless of value.
+        FieldValidator v = Create();
+        var msg = new PlayerStateInput { State = ValidPlayerState() };
+
+        Assert.That(v.ValidatePlayerStateInput(PEER, NewState(), msg), Is.True);
+    }
+
+    [Test]
+    public void NullPosition_InInput_Rejects()
+    {
+        // Malformed proto with unset Position would NRE in the handler; validator must reject.
+        FieldValidator v = Create();
+        var msg = new PlayerStateInput
+        {
+            State = new PlayerState { ParcelIndex = 100, Velocity = new Vector3() },
+        };
+
+        Assert.That(v.ValidatePlayerStateInput(PEER, NewState(), msg), Is.False);
+    }
+
+    [Test]
+    public void NaNPosition_InEmote_RejectsWithEmoteField()
+    {
+        FieldValidator v = Create();
+        EmoteStart msg = ValidEmoteStart();
+        msg.PlayerState.Position = new Vector3 { X = float.NaN, Y = 0, Z = 0 };
+
+        Assert.That(v.ValidateEmoteStart(PEER, NewState(), msg), Is.False);
+        transport.Received(1).Disconnect(PEER, DisconnectReason.INVALID_EMOTE_FIELD);
+    }
+
+    [Test]
+    public void NaNPosition_InTeleport_RejectsWithTeleportField()
+    {
+        FieldValidator v = Create();
+        TeleportRequest msg = ValidTeleport();
+        msg.Position = new Vector3 { X = float.NaN, Y = 0, Z = 0 };
+
+        Assert.That(v.ValidateTeleport(PEER, NewState(), msg), Is.False);
+        transport.Received(1).Disconnect(PEER, DisconnectReason.INVALID_TELEPORT_FIELD);
+    }
+
     [Test]
     public void OutOfRangeParcel_InTeleport_Rejects()
     {