Loose handling of item NBT allows creation of fraudulent items.
MHFDoge opened this issue ยท 5 comments
๐ Description (REQUIRED)
There is currently a bug involving Slimefun accepting renamed items as legitimate slimefun objects. I noticed that legitimate slimefun objects have an NBT tag applied to them which I originally thought was what the plugin used to determine whether an item is a slimefun item or not, but alas this does not appear to be the case on both a production server and locally. This appears to be present on the most recent release at the time of writing this(RC-20(da6866e)) although, as expected, is present in past releases as well.
๐ Steps to reproduce the Issue (REQUIRED)
- Ensure you have some way to rename items(essentials /irename for example)
- Set the name of an item of the same type to the matching contents of a slimefun item that does not have lore(ex: renaming a player head to
&4Carbon Chunk
(yes this also works with items that are present as heads)) - Attempt to use that item in a slimefun machine for whatever the item is usable for(ex: lead dust in a smeltery turns into a lead ingot)
๐ก Expected behavior (REQUIRED)
Expected behavior: The item does not work, as it is lacking the proper Slimefun NBT tag and is just a renamed item.
Actual behavior: The item behaves as if it were a legitimate item.
Below: Actual slimefun item.
Below: Fraudulent slimefun item.
Both behave as proper items even though one is not.
๐ Server Log
N/A
๐ /error-reports/ Folder
N/A
๐งญ Environment (REQUIRED)
- Server Software: Paper build 463
- Minecraft Version: 1.16.5
- Slimefun Version: RC 20 (da6866e)
Duplicate of #2842
Duplicate of #2832
Duplicate of #2797
And also duplicate of #2582 (underlying problem is the same).
I know that googling or searching for issues before posting might be a bit of an effort...
But I am quite tired of repeating myself over and over again at this point.
Don't allow your players to rename items with color codes, simple solution for now.
If the items are handled by name and lore then what is the purpose of the applied slimefun nbt tag is if it is not functioning.?
I linked you more than enough sources already.
I really see no point in repeating myself yet again...
Clicking a link and reading is not too much to ask for.
I am locking this thread as spam, if you have any further questions, feel free to ask them on discord - though everything has already been answered already.