A few *small* changes and a fix.

[Totobird-Creations]

trafficstars

A few small changes and a fix (Definitely did not rewrite half of the mod). Here's what I did:

---

1.21

• I switched the main branch over to 1.21.
• Maintaining the 1.20.x branches is as simple as swapping the two uses of PlainTextContent.Literal in the CombinedFilter class with LiteralTextContent. Everything else is compatible.

Translation Key Source is Now Considered

• Translation keys from vanilla resource packs (vanilla and realms) are unfiltered.
• Translation keys in server resource packs are now unfiltered (and collision-safe). When resources reload, MDP will now collect all keys from server resource packs, as well as their values. When the server requests one, MDP will send back what the server sent in the pack, even if a different local (non-server) pack overrides it.
  • This should hopefully fix the vulnerability found in #6 (the specific comment in question).
• Modded translations and translations in local resource packs are still blocked.

Keybinds are Falsified

• When a server uses this exploit to request a keybind, MDP will send back the factory setting key of the keybind. For example, if the server requests the key.sprint key, the player can have R as their sprint key, but MDP will respond with Left Control (localised).
• This only applies to vanilla keybinds. Non-vanilla keybinds are still blocked.
• Since the server has access to the client language through SyncedClientOptions, sending a different language than the one the server thinks the client is supposed to have loaded could potentially be detected. Thus, I decided to not make translations send back the default en_us value like the keybinds do.

De-hardcoding

• I removed the hardcoded vanilla keybinds list, and the vanilla keybinds gzip file. They are now automatically detected when the game starts, or when the resource pack reloads.

Logging Messages

• When MDP allows, blocks, or falsifies a keybind/translation key, it will print a warning in chat. This could be useful for probing certain servers.

Compatability

• I replaced the @Redirects with @WrapOperations, from LlamaLad7's MixinExtras library. @Redirect may collide with other mods, while @WrapOperation will not collide with other mods. This library pretty much just comes with fabric.

---

I have tested this on a server which I know has a system which can detect the previous version of MDP. They did not detect any mods I have installed, and can not detect MDP by introducing their own translation keys.

[Totobird-Creations]

Just pushed a commit which fixes a bug causing keybinds from certain mods (Freecam for example) to be classified as vanilla, and allowed to pass through.

[JustAlittleWolf]

Hello, thanks for the pr! Unfortunately I don't have that much time at the moment, I won't be able to merge it soon.

About the project itself: I am no longer interested in maintaining this mod (because I don't want to be responsible for people getting into trouble for using it). This means, your change won't be put on modrinth or curseforge by me. However, I am open to someone taking over the project.

Cheers!

[xCheezie]

I still have the ressource pack failed kick message in Cytooxien server

[1zun4]

Hello, thanks for the pr! Unfortunately I don't have that much time at the moment, I won't be able to merge it soon.

About the project itself: I am no longer interested in maintaining this mod (because I don't want to be responsible for people getting into trouble for using it). This means, your change won't be put on modrinth or curseforge by me. However, I am open to someone taking over the project.

Cheers!

It would be great if someone would take over the project if you decide not to update it. The implementation from the PR looks good to me, except for the very strange @Totobird-Creations code style. :sweat_smile:

[NikOverflow]

I'm working on a Mod that will prevent all these issues and more. Here is a blog post and i'm also involved in it: https://alaggydev.github.io/posts/cytooxien/

The Mod is already on Modrinth and Github but don't use the Modrinth version yet until the next release because there are a few detection methods and the anvil is broken.

Modrinth: https://modrinth.com/mod/exploitpreventer Github: https://github.com/NikOverflow/ExploitPreventer

@JustAlittleWolf if you want you can name this mod in the readme. Some issues this mod also tries to prevent is that you can do local http requests to the internal network from the player. You can't get a response but a hash.

[xCheezie]

oh nice

[NikOverflow]

oh nice

Yeah this pr is actually missing a second way to allow Cytooxien resource packs.

[xCheezie]

you think you will be able to make a version for 1.21.8?

[NikOverflow]

you think you will be able to make a version for 1.21.8?

At some point I really wanna backport it but not now. What you can do is use that version with ViaFabricPlus and then you should be able to join a 1.21.8 server.

[NikOverflow]

The newest version on Modrinth can now be used.