Add depth limit to Component deserialization (#145)

2025-07-02 10:06:41 +00:00 · 2024-02-07 11:40:11 +11:00
parent 0030c335bf
commit f00572a121
12 changed files with 158 additions and 31 deletions
--- a/patches/server/0051-Add-depth-limit-to-Component-deserialization.patch
+++ b/patches/server/0051-Add-depth-limit-to-Component-deserialization.patch
@ -0,0 +1,127 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Focusvity <nathan.curran10012@gmail.com>
+Date: Mon, 5 Feb 2024 19:39:23 +1100
+Subject: [PATCH] Add depth limit to Component deserialization
+
+
+diff --git a/src/main/java/net/minecraft/network/chat/Component.java b/src/main/java/net/minecraft/network/chat/Component.java
+index ba13650b52e39c9cc5cfa421f7720c7d4ba75678..f500b4aa5aaea89a2a878afe70d386f044401be4 100644
+--- a/src/main/java/net/minecraft/network/chat/Component.java
+++ b/src/main/java/net/minecraft/network/chat/Component.java
+@@ -3,9 +3,11 @@ package net.minecraft.network.chat;
+ import com.google.common.collect.Lists;
+ import com.google.gson.Gson;
+ import com.google.gson.GsonBuilder;
+import com.google.gson.JsonArray;
+ import com.google.gson.JsonDeserializationContext;
+ import com.google.gson.JsonDeserializer;
+ import com.google.gson.JsonElement;
+import com.google.gson.JsonObject;
+ import com.google.gson.JsonParseException;
+ import com.google.gson.JsonParser;
+ import com.google.gson.JsonSerializationContext;
+@@ -13,6 +15,7 @@ import com.google.gson.JsonSerializer;
+ import com.google.gson.stream.JsonReader;
+ import com.mojang.brigadier.Message;
+ import com.mojang.serialization.JsonOps;
+
+ import java.io.StringReader;
+ import java.lang.reflect.Type;
+ import java.util.ArrayList;
+@@ -24,6 +27,7 @@ import java.util.Optional;
+ import java.util.UUID;
+ import javax.annotation.Nullable;
+ 
+import me.totalfreedom.scissors.ScissorsConfig; // Scissors
+ import net.minecraft.ChatFormatting;
+ import net.minecraft.Util;
+ import net.minecraft.network.chat.contents.DataSource;
+@@ -35,8 +39,10 @@ import net.minecraft.network.chat.contents.SelectorContents;
+ import net.minecraft.network.chat.contents.TranslatableContents;
+ import net.minecraft.resources.ResourceLocation;
+ import net.minecraft.util.FormattedCharSequence;
+import net.minecraft.util.GsonHelper;
+ import net.minecraft.world.level.ChunkPos;
+ // CraftBukkit start
+import java.util.regex.Pattern; // Scissors
+ import java.util.stream.Stream;
+ // CraftBukkit end
+ 
+@@ -272,7 +278,8 @@ public interface Component extends Message, FormattedText, Iterable<Component> {
+ 
+     public static class SerializerAdapter implements JsonDeserializer<MutableComponent>, JsonSerializer<Component> {
+ 
+-        public SerializerAdapter() {}
+        public SerializerAdapter() {
+        }
+ 
+         public MutableComponent deserialize(JsonElement jsonelement, Type type, JsonDeserializationContext jsondeserializationcontext) throws JsonParseException {
+             return Component.Serializer.deserialize(jsonelement);
+@@ -286,10 +293,66 @@ public interface Component extends Message, FormattedText, Iterable<Component> {
+     public static class Serializer {
+ 
+         private static final Gson GSON = (new GsonBuilder()).disableHtmlEscaping().create();
+        private static final Pattern PLACEHOLDER_PATTERN = Pattern.compile("%[0-9]+\\$s"); // Scissors
+
+        private Serializer() {
+        }
+ 
+-        private Serializer() {}
+        // Scissors start
+        static int depthChecker(int depth) {
+            depth = depth + 1;
+            if (depth > ScissorsConfig.componentDepthLimit) {
+                throw new JsonParseException("Depth limit exceeded");
+            }
+            return depth;
+        }
+
+        static int getPenalty(String string) {
+            if (PLACEHOLDER_PATTERN.matcher(string).find()) {
+                long translate_placeholders = PLACEHOLDER_PATTERN.matcher(string).results().count();
+                return (int) translate_placeholders * 12;
+            }
+            return 0;
+        }
+ 
+         static MutableComponent deserialize(JsonElement json) {
+            int depth = 1;
+            if (!json.isJsonPrimitive()) {
+                if (!json.isJsonObject()) {
+                    if (json.isJsonArray()) {
+                        JsonArray jsonArray = json.getAsJsonArray();
+                        if (jsonArray.size() <= 0) throw new JsonParseException("Unexpected empty array of components");
+
+                        for (JsonElement ignored : jsonArray) {
+                            depth = depthChecker(depth);
+                        }
+                    }
+                } else {
+                    JsonObject jsonObject = json.getAsJsonObject();
+                    if (jsonObject.has("translate")) {
+                        String s = GsonHelper.getAsString(jsonObject, "translate");
+                        int penalty = getPenalty(s);
+                        depth = depthChecker(depth + penalty);
+
+                        if (jsonObject.has("with")) {
+                            String s1 = GsonHelper.getAsJsonArray(jsonObject, "with").toString();
+                            penalty = getPenalty(s1);
+                            depth = depthChecker(depth + penalty);
+                        }
+                    }
+
+                    if (jsonObject.has("extra")) {
+                        JsonArray jsonArray = GsonHelper.getAsJsonArray(jsonObject, "extra");
+                        if (jsonArray.size() <= 0) throw new JsonParseException("Unexpected empty array of components");
+
+                        for (JsonElement ignored : jsonArray) {
+                            depth = depthChecker(depth);
+                        }
+                    }
+                }
+            }
+            // Scissors end
+
+             return (MutableComponent) Util.getOrThrow(ComponentSerialization.CODEC.parse(JsonOps.INSTANCE, json), JsonParseException::new);
+         }
+