Exploit: Copying Buildings with Containers Retains Item Data
sion1021 opened this issue · 8 comments
Is there an existing issue for this?
- I have searched the existing issues.
Are you using the latest Structurize Version?
- I am running the latest beta/release version of Structurize for my Minecraft version.
I am also running the latest versions of other mods that are part of my problem.
Did you check on the Wiki? or ask on Discord?
Minecraft Version
1.21
Structurize Version
minecolonies-1.1.990-1.21.1-snapshot
MineColonies Version (if related bug)
minecolonies-1.1.990-1.21.1-snapshot
Related Mods and their Versions
minecolonies-1.1.990-1.21.1-snapshot.jar
stylecolonies-1.14-1.21.1
Byzantine-1.21.1-33
structurize-1.0.775-1.21.1-snapshot
domum-ornamentum-1.0.213-snapshot-main
blockui-1.0.199-1.21.1-snapshot
toms_storage-1.21-2.2.0
Current Behavior
When duplicating buildings containing container blocks using MineColonies blueprints, the NBT data inside those containers is preserved. This allows players to duplicate items inside containers, and even import rare or restricted items from single-player mode via blueprints.
Expected Behavior
When duplicating buildings via blueprints, all NBT data inside container blocks should be cleared, so containers should be empty in the copied building.
Reproduction Steps
- In single-player creative mode, run the following command:
/give @p minecraft:redstone_block{BlockEntityTag:{Items:[{Slot:0b,id:"minecraft:command_block",Count:1b}]}} - Use this redstone block in a MineColonies blueprint.
- Import the blueprint to a server or another world.
- Retrieve the redstone block from the blueprint.
- Destroy the block using fire to get the contained command block.
Logs
No relevant logs. This is a game mechanic exploit.
Anything else?
Hello, thank you very much for creating the MineColonies mod and for all your hard work in developing and maintaining it. I truly appreciate your efforts.
While playing recently, I discovered a potential issue related to the building blueprint system involving container blocks. I’d like to report it for your review and consideration.
Details:
In Minecraft, container-type blocks (such as chests, hoppers, command blocks, etc.) store their item data within their own NBT data. However, when MineColonies’ blueprint system copies buildings, it only checks the block type and state, without verifying or clearing the NBT data inside these containers. As a result, players can duplicate items stored inside these container blocks by duplicating the buildings that contain them.
More seriously, I found that this method can also be used to import rare or restricted items from single-player mode into a multiplayer server via blueprints. For example:
In single-player creative mode, use the command:
/give @p minecraft:redstone_block{BlockEntityTag:{Items:[{Slot:0b,id:"minecraft:command_block",Count:1b}]}}
to create a redstone block containing a command block.
Save this redstone block into a blueprint.
Import the blueprint into a multiplayer server.
Take out the redstone block from the blueprint and break it with fire without placing it, and the contained items can be obtained.
This can disrupt the server's item rarity and game balance.
Suggested solutions:
Review the blueprint system’s mechanism for validating and handling NBT data in container blocks.
Or, when copying a building, automatically clear all NBT data from container blocks (such as chests, hoppers, command blocks, etc.) to ensure they are empty when duplicated.
If needed, I’d be happy to help reproduce this issue for testing and debugging purposes.
Thank you again for your outstanding mod development work!
Footer
Viewers
- Add a thumbs-up to the bug report if you are also affected. This helps the bug report become more visible to the team and doesn't clutter the comments.
- Add a comment if you have any insights or background information that isn't already part of the conversation.
When you use creative paste, duplicating container content is intended. You're in creative mode, you get things for free.
When the minecolonies builder builds things (and those things are a regular container block like a chest), they should either leave the container empty or demand the items that are in the container as part of the build (different versions have done different things due to quirks in how minecraft reports container contents). Only if the builder is magicking in the items without this is it a bug. Is this what's happening?
Blocks that are not container blocks that you've forced to contain things via command shenanigans are not supported. Don't do that. (I didn't think you could even do that; maybe that's a new quirk in 1.21.)
Yeah, the problem here is that the builder does a soft match on these. We'd need to add a "reset inventory contents of items when adding them".
When you use creative paste, duplicating container content is intended. You're in creative mode, you get things for free.
When the minecolonies builder builds things (and those things are a regular container block like a chest), they should either leave the container empty or demand the items that are in the container as part of the build (different versions have done different things due to quirks in how minecraft reports container contents). Only if the builder is magicking in the items without this is it a bug. Is this what's happening?
Blocks that are not container blocks that you've forced to contain things via command shenanigans are not supported. Don't do that. (I didn't think you could even do that; maybe that's a new quirk in 1.21.)
My previous description might have been unclear, so I’d like to re-explain the reproduction steps for this bug.
It’s important to note that this bug also occurs when players are in Survival Mode, which makes it a highly critical issue from a server management perspective.
Here’s the detailed reproduction process:
1：Place a Rack from the MineColonies mod on the ground, and store a stack of diamonds inside the rack (as shown in images 1-3).
2：Use a scan tool to scan the rack and assign it to a builder for construction (as shown in images 4-8).
3：During construction, the builder only needs to place one rack, but the newly placed rack still contains the same stack of diamonds inside (as shown in images 9-10).
4：This bug is not limited to the Rack from MineColonies — any other item with container components can trigger the same issue.
For example, a Traveler’s Backpack. Even in a clean environment with no other mods, if you replace the backpack in the chest with an item obtained via command that has a container tag (like the Redstone Block I mentioned in my initial bug report), the same issue occurs (as shown in images 11-18).
Just to add, structurize in 1.21 itself alone produces exact requirements included nested inventories like shulker, so this would be probably minecolonies or placement logic bug of discarding that data somewhere.
Can you test with latest BlockUI to confirm its still a problem?
Yes, after I updated to the latest BlockUI (blockui-1.0.204-1.21.1-snapshot), this vulnerability has been fixed.
Same issue occurs in 1.20
blockui 1.20.1-1.0.193
domum_ornamentum 1.20.1-1.0.290-snapshot
minecolonies 1.20.1-1.1.1010-snapshot
structurize 1.20.1-1.0.780-snapshot