Lorenzo0111 / QualityArmory

A quality gun plugin similar to CrackShot.
GNU General Public License v3.0
95 stars 50 forks source link

Potential security issue #564

Closed ghost closed 8 months ago

ghost commented 8 months ago

Confirmations

What happened?

Checking event.getView().getTitle() to see whether your custom inventory is being used is unsafe, as renaming a chest in an anvil allows users to set their own inventory titles. The correct way to check if your custom inventory is involved with an event is by using custom holders, see here: https://docs.papermc.io/paper/dev/custom-inventory-holder

https://github.com/Lorenzo0111/QualityArmory/blob/c22b9085c8ad2ac6b9b6cbb23aba8d358268fa83/src/main/java/me/zombie_striker/qg/listener/QAListener.java#L257

Expected Behaviour

N/A

Plugins

N/A

Server Version

N/A

Relevant log output

No response