3
3
Date: Fri, 9 Dec 2022 13:17:43 -0300
4
4
Subject: [PATCH] Book security improvements
5
5
6
- Co-authored-by: RoccoDev
7
6
Co-authored-by: bob7l
7
+ Co-authored-by: RoccoDev <
[email protected] >
8
+ Co-authored-by: xism4 <
[email protected] >
9
+ Co-authored-by: linsaftw <
[email protected] >
8
10
9
11
diff --git a/src/main/java/net/minecraft/server/PacketDataSerializer.java b/src/main/java/net/minecraft/server/PacketDataSerializer.java
10
12
index ad33280bb8baab581a4ac17b5fe78022134c676b..a6480484f2c2f55e6cb4ef682c99f56d46980a0e 100644
@@ -20,7 +22,7 @@ index ad33280bb8baab581a4ac17b5fe78022134c676b..a6480484f2c2f55e6cb4ef682c99f56d
20
22
}
21
23
22
24
diff --git a/src/main/java/net/minecraft/server/PlayerConnection.java b/src/main/java/net/minecraft/server/PlayerConnection.java
23
- index 14afdc7cbb88150f4711811a06fa149c36cec8b9..3904c77141ec3b778dc6cc2fd256961b7598ab31 100644
25
+ index 1f80521c97fd7b0ef263b9e17cb79bcc51db0433..f5ef763b8783a6a275b5d4311d368bed25e3b878 100644
24
26
--- a/src/main/java/net/minecraft/server/PlayerConnection.java
25
27
+++ b/src/main/java/net/minecraft/server/PlayerConnection.java
26
28
@@ -111,6 +111,7 @@ public class PlayerConnection implements PacketListenerPlayIn, IUpdatePlayerList
@@ -60,10 +62,10 @@ index 14afdc7cbb88150f4711811a06fa149c36cec8b9..3904c77141ec3b778dc6cc2fd256961b
60
62
61
63
try {
62
64
diff --git a/src/main/java/org/bukkit/craftbukkit/inventory/CraftMetaBook.java b/src/main/java/org/bukkit/craftbukkit/inventory/CraftMetaBook.java
63
- index 0b5ada0118f521eaca65b0fd67ebf232fa183b1a..8f46643ddcd0365c842384268a92aa475f03a97c 100644
65
+ index 0b5ada0118f521eaca65b0fd67ebf232fa183b1a..44b3c3ac151fecebd41b43b7bb6708cb8508dc50 100644
64
66
--- a/src/main/java/org/bukkit/craftbukkit/inventory/CraftMetaBook.java
65
67
+++ b/src/main/java/org/bukkit/craftbukkit/inventory/CraftMetaBook.java
66
- @@ -33,8 +33,11 @@ public class CraftMetaBook extends CraftMetaItem implements BookMeta {
68
+ @@ -33,8 +33,12 @@ public class CraftMetaBook extends CraftMetaItem implements BookMeta {
67
69
static final ItemMetaKey BOOK_PAGES = new ItemMetaKey("pages");
68
70
static final ItemMetaKey RESOLVED = new ItemMetaKey("resolved");
69
71
static final ItemMetaKey GENERATION = new ItemMetaKey("generation");
@@ -72,12 +74,13 @@ index 0b5ada0118f521eaca65b0fd67ebf232fa183b1a..8f46643ddcd0365c842384268a92aa47
72
74
+ // PandaSpigot start - Add security limits to books
73
75
+ static final int MAX_PAGES = 50;
74
76
+ static final int MAX_PAGE_LENGTH = 256;
75
- + static final int MAX_TITLE_LENGTH = 32;
77
+ + static final int MAX_TITLE_LENGTH = 16;
78
+ + static final int MAX_AUTHOR_LENGHT = 16;
76
79
+ // PandaSpigot end
77
80
78
81
protected String title;
79
82
protected String author;
80
- @@ -61,11 +64 ,11 @@ public class CraftMetaBook extends CraftMetaItem implements BookMeta {
83
+ @@ -61,11 +65 ,11 @@ public class CraftMetaBook extends CraftMetaItem implements BookMeta {
81
84
super(tag);
82
85
83
86
if (tag.hasKey(BOOK_TITLE.NBT)) {
@@ -87,11 +90,11 @@ index 0b5ada0118f521eaca65b0fd67ebf232fa183b1a..8f46643ddcd0365c842384268a92aa47
87
90
88
91
if (tag.hasKey(BOOK_AUTHOR.NBT)) {
89
92
- this.author = limit( tag.getString(BOOK_AUTHOR.NBT), 1024 ); // Spigot
90
- + this.author = limit( tag.getString(BOOK_AUTHOR.NBT), 16 ); // Spigot // PandaSpigot
93
+ + this.author = limit( tag.getString(BOOK_AUTHOR.NBT), MAX_AUTHOR_LENGHT ); // Spigot // PandaSpigot
91
94
}
92
95
93
96
boolean resolved = false;
94
- @@ -80,7 +83 ,7 @@ public class CraftMetaBook extends CraftMetaItem implements BookMeta {
97
+ @@ -80,7 +84 ,7 @@ public class CraftMetaBook extends CraftMetaItem implements BookMeta {
95
98
if (tag.hasKey(BOOK_PAGES.NBT) && handlePages) {
96
99
NBTTagList pages = tag.getList(BOOK_PAGES.NBT, 8);
97
100
@@ -100,7 +103,7 @@ index 0b5ada0118f521eaca65b0fd67ebf232fa183b1a..8f46643ddcd0365c842384268a92aa47
100
103
String page = pages.getString(i);
101
104
if (resolved) {
102
105
try {
103
- @@ -90,7 +93 ,7 @@ public class CraftMetaBook extends CraftMetaItem implements BookMeta {
106
+ @@ -90,7 +94 ,7 @@ public class CraftMetaBook extends CraftMetaItem implements BookMeta {
104
107
// Ignore and treat as an old book
105
108
}
106
109
}
@@ -109,7 +112,7 @@ index 0b5ada0118f521eaca65b0fd67ebf232fa183b1a..8f46643ddcd0365c842384268a92aa47
109
112
}
110
113
}
111
114
}
112
- @@ -104,7 +107 ,9 @@ public class CraftMetaBook extends CraftMetaItem implements BookMeta {
115
+ @@ -104,7 +108 ,9 @@ public class CraftMetaBook extends CraftMetaItem implements BookMeta {
113
116
114
117
Iterable<?> pages = SerializableMeta.getObject(Iterable.class, map, BOOK_PAGES.BUKKIT, true);
115
118
if(pages != null) {
@@ -119,3 +122,15 @@ index 0b5ada0118f521eaca65b0fd67ebf232fa183b1a..8f46643ddcd0365c842384268a92aa47
119
122
if (page instanceof String) {
120
123
addPage((String) page);
121
124
}
125
+ @@ -188,7 +194,10 @@ public class CraftMetaBook extends CraftMetaItem implements BookMeta {
126
+ this.title = null;
127
+ return true;
128
+ } else if (title.length() > MAX_TITLE_LENGTH) {
129
+ - return false;
130
+ + // PandaSpigot start
131
+ + this.title = title.substring(0, MAX_TITLE_LENGTH);
132
+ + return true;
133
+ + // PandaSpigot end
134
+ }
135
+
136
+ this.title = title;
0 commit comments