Residence

Residence

960k Downloads

UUID Code: Massive Performance Risk / Bug

aikar opened this issue ยท 0 comments

commented

Re: https://github.com/bekvon/Residence/blob/master/src/com/bekvon/bukkit/residence/Residence.java#L810-L825

getOfflinePlayers() is an extremely dangerous operation. I understand this is needed for the initial conversion, but this code should only be in a separate method that is only called during that initial conversion.

To get a UUID for an offline player, there are some other libraries out there you can use that calls the mojang API (or cacheing proxy API's) that will be faster and safer than iterating all offline players which on an old server is pretty much guaranteed to crash the server / time everyone out.

For example I have 84k player files on my oldest server... That would be devastating.

What's scary is this method is called on Residence object creation. So if you have say 1k residences, that startup is pretty much doomed.

Or if you change owner of a res to another offline player, again server hang.

Additionally, you should not use Residence.getServ().getPlayer() - this is the wrong API. You're looking for getPlayerExact().
getPlayer has different behavior than you are expecting. It does not do an exact name lookup and can return a different player than you are expecting.

Finally, why is Residence.getServ() a thing? You can replace all with Bukkit.getServer()