search

Aust1n46 / VentureChat

GNU General Public License v3.0
37 stars 46 forks source link

Potential security issue #111

Open ghost opened 5 months ago

ghost commented 5 months ago

https://github.com/Aust1n46/VentureChat/blob/05762e0bc7b12e465cc7124138ea20130b57b9fc/src/main/java/mineverse/Aust1n46/chat/listeners/CommandListener.java#L142

Checking event.getView().getTitle() to see whether your custom inventory is being used is unsafe, as renaming a chest in an anvil allows users to set their own inventory titles. The correct way to check if your custom inventory is involved with an event is by using custom holders, see here: https://docs.papermc.io/paper/dev/custom-inventory-holder

HugKitten commented 5 months ago

It's surprising how often this mistake is made

Aust1n46 commented 4 months ago

Made it 10 years before anyone noticed ;)