Nocsy-Workshop / mcpets

MCPets plugin for Minecraft Spigot - Made by Nocsy | Partnered with MCModels.net
https://www.patreon.com/tofnocsy_workshop
GNU General Public License v3.0
56 stars 33 forks source link

Potential security issue #31

Open ghost opened 10 months ago

ghost commented 10 months ago

Checking event.getView().getTitle() to see whether your custom inventory is being used is unsafe, as renaming a chest in an anvil allows users to set their own inventory titles. The correct way to check if your custom inventory is involved with an event is by using custom holders, see here: https://docs.papermc.io/paper/dev/custom-inventory-holder

https://github.com/Nocsy-Workshop/mcpets/blob/bb27b3ef29c1a74c8d0790aca55029391f5c6f3b/src/main/java/fr/nocsy/mcpets/listeners/CategoriesMenuListener.java#L18

AlexandreChaussard commented 9 months ago

Thanks for the material! I had no clue it was done that way, I'll see when I can add it =)