search

Rosewood-Development / RoseStacker

A next-generation stacker plugin for Spigot and Paper servers
Other
139 stars 36 forks source link

Empty Spawner Exploit #118

Closed ericlmao closed 1 month ago

ericlmao commented 1 month ago

On servers that allow you to customize the names of items using means such as an anvil or commands, you can set an empty spawner's name to whatever you desire (eg. Zombie Spawner) and when placed, it will change the spawner's type to the specified name.

According to the codebase, this is an intentional design. But we should get a configuration option to allow us to disable those specified checks.

Here is a video showing off what I'm referring to: https://www.youtube.com/watch?v=rVdTJqzieA0

Esophose commented 1 month ago

It is intentional but only if the item is named with a colored name, which shouldn't be possible through an anvil usually, how did you get a color in there?

ericlmao commented 1 month ago

It is intentional but only if the item is named with a colored name, which shouldn't be possible through an anvil usually, how did you get a color in there?

We use a plugin to allow users to color their items inside anvils. A lot of SMP servers have the same (or similar) feature where we can allow customized names for items.