Add depth limit to SNBT (#88)

build-data/dev-imports.txt

@@ -8,3 +8,4 @@
 # To import classes from the vanilla Minecraft jar use `minecraft` as the artifactId:
 #     minecraft net.minecraft.world.level.entity.LevelEntityGetterAdapter
 #     minecraft net/minecraft/world/level/entity/LevelEntityGetter.java
+minecraft net/minecraft/nbt/TagParser.java

patches/server/0054-Add-depth-limit-to-SNBT.patch

@@ -0,0 +1,116 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Allink <arclicious@vivaldi.net>
+Date: Fri, 2 Jun 2023 23:30:40 +0100
+Subject: [PATCH] Add depth limit to SNBT
+
+
+diff --git a/src/main/java/net/minecraft/nbt/TagParser.java b/src/main/java/net/minecraft/nbt/TagParser.java
+index 28a13331ac7713cde725bf7c7ce6be959227d506..4f5573d1cc5630519122010d44f0a82e2948e767 100644
+--- a/src/main/java/net/minecraft/nbt/TagParser.java
++++ b/src/main/java/net/minecraft/nbt/TagParser.java
+@@ -169,8 +169,58 @@ public class TagParser {
+         }
+ 
+         this.expect('}');
+-        return compoundTag;
++
++        // Scissors start - Add depth limit to SNBT
++        return exceedsDepthLimit(compoundTag) ? new CompoundTag() : compoundTag;
++        // Scissors end
++    }
++
++    // Scissors start - Add depth limit to SNBT
++    private boolean exceedsDepthLimit(Tag tag) {
++        return this.exceedsDepthLimit(0, tag);
++    }
++
++    private boolean exceedsDepthLimit(long depth, Tag tag)
++    {
++        if (depth > 256)
++        {
++            return true;
++        }
++
++        if (tag instanceof ListTag listTag)
++        {
++            for (Tag childTag : listTag)
++            {
++                boolean returnValue = this.exceedsDepthLimit(depth + 1, childTag);
++
++                if (returnValue)
++                {
++                    return true;
++                }
++            }
++        } else if (tag instanceof CompoundTag compoundTag)
++        {
++            for (String key: compoundTag.getAllKeys())
++            {
++                Tag childTag = compoundTag.get(key);
++
++                if (childTag == null)
++                {
++                    continue;
++                }
++
++                boolean returnValue = this.exceedsDepthLimit(depth + 1, childTag);
++
++                if (returnValue)
++                {
++                    return true;
++                }
++            }
++        }
++
++        return false;
+     }
++    // Scissors end
+ 
+     private Tag readListTag() throws CommandSyntaxException {
+         this.expect('[');
+@@ -203,7 +253,11 @@ public class TagParser {
+             }
+ 
+             this.expect(']');
+-            return listTag;
++
++            // Scissors start - Add depth limit to SNBT
++            return exceedsDepthLimit(listTag) ? new ListTag() : listTag;
++            // return listTag;
++            // Scissors end
+         }
+     }
+ 
+@@ -228,7 +282,7 @@ public class TagParser {
+     }
+ 
+     private <T extends Number> List<T> readArray(TagType<?> arrayTypeReader, TagType<?> typeReader) throws CommandSyntaxException {
+-        List<T> list = Lists.newArrayList();
++        List<Number> list = Lists.newArrayList(); // Scissors - List<T> -> List<Number>
+ 
+         while(true) {
+             if (this.reader.peek() != ']') {
+@@ -241,11 +295,11 @@ public class TagParser {
+                 }
+ 
+                 if (typeReader == ByteTag.TYPE) {
+-                    list.add((T)((NumericTag)tag).getAsByte());
++                    list.add(((NumericTag)tag).getAsByte()); // Scissors - Remove (T) cast
+                 } else if (typeReader == LongTag.TYPE) {
+-                    list.add((T)((NumericTag)tag).getAsLong());
++                    list.add(((NumericTag)tag).getAsLong()); // Scissors - Remove (T) cast
+                 } else {
+-                    list.add((T)((NumericTag)tag).getAsInt());
++                    list.add(((NumericTag)tag).getAsInt()); // Scissors - Remove (T) cast
+                 }
+ 
+                 if (this.hasElementSeparator()) {
+@@ -257,7 +311,7 @@ public class TagParser {
+             }
+ 
+             this.expect(']');
+-            return list;
++            return (List<T>) list; // Scissors - Cast to List<T>
+         }
+     }
+