EngineHub / WorldGuard

🛡️ Protect your Minecraft server and lets players claim areas
https://enginehub.org/worldguard/
Other
820 stars 541 forks source link

Can bypass regions with mob spawn egg when used on water. #2000

Open crumpkatrina opened 1 year ago

crumpkatrina commented 1 year ago

WorldEdit Version

Bukkit-Official(7.2.15-SNAPSHOT+6372-93c0d36)

WorldGuard Version

Bukkit-Official (7.0.8-SNAPSHOT+2231-bddfbdd)

Platform Version

Paper 1.19.4 Build 514

Confirmations

Bug Description

When inside a region you do not have access to, aiming at water, at just the right angle, so your client isn't selecting any block behind the water, as such: (https://i.imgur.com/uIA0HbX.png) as opposed to as such: (https://i.imgur.com/7MzAUji.png) you are able to bypass region protection, and place mob spawn eggs, spawning the mob.

Expected Behavior

Respect region protection and do not allow item usage if not part of the region, regardless of how your client is aimed.

Reproduction Steps

  1. Create region.
  2. Use a typical spawn egg, such as a cow spawn egg.
  3. Aim at water as shown in first screenshot in Bug Description section.
  4. Right click to place mob bypassing protection.

Optional WorldGuard-Report

No response

Anything Else?

Using block-entity-spawns-with-untraceable-cause: true - is a temporary solution, however this breaks a wide variety of other entity spawn related things on the server, to the point where running this setting on true is simply game-breaking.

wizjany commented 1 year ago

there isn't much we can do here short of doing raytraces for every interact. mojang has some specific coding for spawn eggs that do that raytracing internally checking for liquids, and thus bypass bukkit block interaction events.

one could in theory add spawn eggs to the "use at feet" config option, but users could still stand outside the region and place into it.