MinecraftManhunt icon indicating copy to clipboard operation
MinecraftManhunt copied to clipboard

Potential security issue

Open ghost opened this issue 5 months ago • 0 comments

Checking event.getView().getTitle() to see whether your custom inventory is being used is unsafe, as renaming a chest in an anvil allows users to set their own inventory titles. The correct way to check if your custom inventory is involved with an event is by using custom holders, see here: https://docs.papermc.io/paper/dev/custom-inventory-holder

https://github.com/ericyoondotcom/MinecraftManhunt/blob/d4e501883fb1baa90a97cdbad9249825dff510de/MinecraftManhunt/src/main/java/com/yoonicode/minecraftmanhunt/PluginListener.java#L67

ghost avatar Jan 26 '24 21:01 ghost