From dbb289db660ec74a660451f801cca03025b5a951 Mon Sep 17 00:00:00 2001 From: Paul Reilly Date: Fri, 31 Mar 2023 21:33:08 -0500 Subject: [PATCH] Squashed commit of the following: commit cc48f93556109e49039ae42a9df29c4f15c4fd57 Merge: 71127c31 dd373fc9 Author: Paul Reilly Date: Fri Mar 31 21:15:34 2023 -0500 Merge branch 'main' into development commit dd373fc9aa3cfed49f01cebc4adf3c8d2a5c306c Merge: edb3dbfd 41331e71 Author: Paldiu Date: Fri Mar 31 18:25:42 2023 -0500 Merge pull request #307 from AtlasMediaGroup/RELEASE-2022.06.1 Release 2022.06.1 commit 41331e719d3d784f29c109d1a5ad943bb906e94a Author: Video Date: Wed Mar 8 19:58:14 2023 -0700 Updates version to 2022.06.1 commit 72c83ba84a1e01772ecb02143d1eef12773d4986 Merge: edb3dbfd 3deaaafb Author: Video Date: Wed Mar 8 19:53:51 2023 -0700 Merge pull request #306 from AtlasMediaGroup/critical-exploit-fix Patches critical exploit in the command blocker commit 3deaaafb8804d0c6634ab22d970f58ab8c529778 Author: Video Date: Wed Mar 8 19:52:30 2023 -0700 Patches critical exploit --- .../blocking/command/CommandBlocker.java | 10 +++++++++- pom.xml | 1 + 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/commons/src/main/java/me/totalfreedom/totalfreedommod/blocking/command/CommandBlocker.java b/commons/src/main/java/me/totalfreedom/totalfreedommod/blocking/command/CommandBlocker.java index 925ee64f..46b2e4d6 100644 --- a/commons/src/main/java/me/totalfreedom/totalfreedommod/blocking/command/CommandBlocker.java +++ b/commons/src/main/java/me/totalfreedom/totalfreedommod/blocking/command/CommandBlocker.java @@ -24,7 +24,7 @@ import org.bukkit.plugin.SimplePluginManager; public class CommandBlocker extends FreedomService { - + private final Pattern whitespacePattern = Pattern.compile("^/?( +)(.*)?"); private final Pattern flagPattern = Pattern.compile("(:([0-9]){5,})"); // private final Map entryList = Maps.newHashMap(); @@ -157,6 +157,14 @@ public class CommandBlocker extends FreedomService // Format command = command.toLowerCase().trim(); + + // Whitespaces + Matcher whitespaceMatcher = whitespacePattern.matcher(command); + if (whitespaceMatcher.matches() && whitespaceMatcher.groupCount() == 2) + { + command = whitespaceMatcher.group(2); + } + command = command.startsWith("/") ? command.substring(1) : command; // Check for plugin specific commands diff --git a/pom.xml b/pom.xml index 890689b8..4d58e05c 100644 --- a/pom.xml +++ b/pom.xml @@ -13,6 +13,7 @@ discord + UTF-8 Caladrius