Skip to content

Paper 1.21.8 - Bug: Click and Hover tags inside [item] allow execution of dangerous commands #3278

Closed
Closed
Paper 1.21.8 - Bug: Click and Hover tags inside [item] allow execution of dangerous commands#3278
Assignees
devpedrobarbosa

Description

@BAD7777
BAD7777
opened on Aug 12, 2025

Are you using MySQL?

Yes

Are you using a proxy?

Yes - Velocity

"/version ChatControlRed" - plugin version

ChatControl version 11.4.7 Author: kangarko

Optional: Error log

No response

ZIP of "/chc debug"

No response

Steps to reproduce

  1. Rename an item using an anvil and add clickable or hover tags inside its name, e.g. <click:run_command:"/suicide">.
  2. When a player clicks on the item name in chat, the command executes immediately, causing harm (like suicide).
  3. Similarly, clickable admin names can grant OP if clicked accidentally.

What is your expected behavior and what happened instead? How can we reproduce the issue?
Expected behavior: ChatControl should block or sanitize hover and click tags inside [item] placeholders, disallowing commands or any dangerous interactions triggered by item names.
Actual behavior: Click and hover tags inside item names work and can trigger commands, which may harm players or give admins unintended permissions.

Activity

  1. github-actions
    assigned
    devpedrobarbosa
    on Aug 12, 2025

  2. devpedrobarbosa commented on Aug 12, 2025

    @devpedrobarbosa
    devpedrobarbosa
    on Aug 12, 2025
    Contributor

    @BAD7777

    Thanks for sharing that.

    We'll be going through this ASAP.

  3. devpedrobarbosa commented on Aug 14, 2025

    @devpedrobarbosa
    devpedrobarbosa
    on Aug 14, 2025
    Contributor

    @BAD7777

    As an imediate fix, just fill Suggest_Command inside variables/item.yml with anything, even a single space (Sugges_Command: ' ').

    We're working on a proper patch and will release it ASAP.

  4. devpedrobarbosa commented on Aug 14, 2025

    @devpedrobarbosa
    devpedrobarbosa
    on Aug 14, 2025
    Contributor

    @BAD7777

    I've published an update and it comes with a patch for this.

    Will probably improve it, though.

  5. devpedrobarbosa commented on Aug 14, 2025

    @devpedrobarbosa
    devpedrobarbosa
    on Aug 14, 2025
    Contributor

    Please let me know if it works on your end :)

  6. devpedrobarbosa
    closed this as completedon Aug 14, 2025

  7. BAD7777 commented on Aug 14, 2025

    @BAD7777
    BAD7777
    on Aug 14, 2025
    Author
    Image Image

    [item]

    Image Image

  8. BAD7777 commented on Aug 14, 2025

    @BAD7777
    BAD7777
    on Aug 14, 2025
    Author

    You have removed the settings, but they are not by default and that chat does not work the same way. My chat is broken, so I had to roll it back to the old version.

  9. kangarko commented on Aug 14, 2025

    @kangarko
    kangarko
    on Aug 14, 2025
    Owner

    @BAD7777 which settings were removed which you were using?

  10. BAD7777 commented on Aug 14, 2025

    @BAD7777
    BAD7777
    on Aug 14, 2025
    Author

    @BAD7777 which settings were removed which you were using?

    Improve | Simplified plugin settings by removing least used options to improve usability.
    List of removed options and their default state:
    Ignore_Autojoin_If_Left; Ignore_Death_Messages; Support_Variables_In_Variables; Support_Full_PlaceholderAPI_Syntax; Support_Relational_Placeholders; Upgrade_Hex_To_Mini_In_Variables and Make_Chat_Links_Clickable are now always true
    Play_Sound_If_No_Message is now always false

  11. BAD7777 commented on Aug 14, 2025

    @BAD7777
    BAD7777
    on Aug 14, 2025
    Author
    Image

  12. devpedrobarbosa commented on Aug 14, 2025

    @devpedrobarbosa
    devpedrobarbosa
    on Aug 14, 2025
    Contributor

    They were removed but were supposed to be working. Will take a look at that ASAP.

  13. BAD7777 commented on Aug 14, 2025

    @BAD7777
    BAD7777
    on Aug 14, 2025
    Author

    Thank you very much, I'll be waiting. Regarding [item], it still works click.

  14. kangarko commented on Aug 14, 2025

    @kangarko
    kangarko
    on Aug 14, 2025
    Owner

    @BAD7777 are you saying you were using ALL of the removed options? They are still enabled and working (i.e. the Performance keys) we just deleted they from settings.yml

  15. BAD7777 commented on Aug 14, 2025

    @BAD7777
    BAD7777
    on Aug 14, 2025
    Author

    @BAD7777 are you saying you were using ALL of the removed options? They are still enabled and working (i.e. the Performance keys) we just deleted they from settings.yml

    I updated to the latest version, and it caused complete chaos in the chat. Then I reverted to the old version, and everything worked fine again.

    What's shown in the screenshot is likely the default values, but in any case, after reverting to the version one step lower, everything works perfectly.

  16. 2 remaining items

  17. BAD7777 commented on Aug 15, 2025

    @BAD7777
    BAD7777
    on Aug 15, 2025
    Author

    &#D3D3D3 doesnt work <#D3D3D3> work

  18. devpedrobarbosa commented on Aug 15, 2025

    @devpedrobarbosa
    devpedrobarbosa
    on Aug 15, 2025
    Contributor

    Is this the only issue had using 11.4.8?

    If not could you give me examples of what's not working?

  19. BAD7777 commented on Aug 15, 2025

    @BAD7777
    BAD7777
    on Aug 15, 2025
    Author

    At the moment, I only noticed this issue and that's it. [item] Everything works like that, and the button is pressed.

  20. devpedrobarbosa commented on Aug 15, 2025

    @devpedrobarbosa
    devpedrobarbosa
    on Aug 15, 2025
    Contributor

    So you're using hex format &#123456 inside your format like this?

    Image

    If so, did it use to work on previous versions? This is only supposed to work in variables.

  21. BAD7777 commented on Aug 15, 2025

    @BAD7777
    BAD7777
    on Aug 15, 2025
    Author

    yes. im using luckperms prefix and suffix

  22. devpedrobarbosa commented on Aug 15, 2025

    @devpedrobarbosa
    devpedrobarbosa
    on Aug 15, 2025
    Contributor

    So the &#123456 is coming from LuckPerms prefix like this?

    Image

  23. BAD7777 commented on Aug 15, 2025

    @BAD7777
    BAD7777
    on Aug 15, 2025
    Author
    Image

  24. devpedrobarbosa commented on Aug 15, 2025

    @devpedrobarbosa
    devpedrobarbosa
    on Aug 15, 2025
    Contributor

    It's working fine for me.

    Image Image Image

    Could you please clarify where this legacy hex codes are coming from?

    Image

    Also, if you're able to, please test this jar (exact one I'm using) to see if there was some mismatch when publishing.

    ChatControl-dev.zip

  25. BAD7777 commented on Aug 15, 2025

    @BAD7777
    BAD7777
    on Aug 15, 2025
    Author

    Everything is working. Thanks

  26. BAD7777 commented on Aug 15, 2025

    @BAD7777
    BAD7777
    on Aug 15, 2025
    Author

    All that remains now is to fix [item]

  27. devpedrobarbosa commented on Aug 15, 2025

    @devpedrobarbosa
    devpedrobarbosa
    on Aug 15, 2025
    Contributor

    @BAD7777

    Just to clarify:

    1. Did it work immediately after you started using the Jar I sent you? (if you did try it)
    2. What excatly is not working about [item]?

  28. BAD7777 commented on Aug 15, 2025

    @BAD7777
    BAD7777
    on Aug 15, 2025
    Author

    @BAD7777

    Just to clarify:

    1. Did it work immediately after you started using the Jar I sent you? (if you did try it)
    2. What excatly is not working about [item]?
    1. yes, work colors
    2. the click vulnerability is still working

  29. devpedrobarbosa commented on Aug 16, 2025

    @devpedrobarbosa
    devpedrobarbosa
    on Aug 16, 2025
    Contributor

    @BAD7777

    Thanks for the update. I fixed it. Will be released ASAP.

  30. BAD7777 commented on Aug 16, 2025

    @BAD7777
    BAD7777
    on Aug 16, 2025
    Author

    goods, thanks!

    [ChatControl] Original text: <gray>[<yellow>64x <white><click:run_command:"/suicide">d<gray>]
[ChatControl] Found tag: <click:run_command:"/suicide">
[ChatControl] Replaced text: <gray>[<yellow>64x <white>d<gray>]

  31. devpedrobarbosa commented on Aug 16, 2025

    @devpedrobarbosa
    devpedrobarbosa
    on Aug 16, 2025
    Contributor

    goods, thanks!

    [ChatControl] Original text: <gray>[<yellow>64x <white><click:run_command:"/suicide">d<gray>]
[ChatControl] Found tag: <click:run_command:"/suicide">
[ChatControl] Replaced text: <gray>[<yellow>64x <white>d<gray>]

    Thanks for sharing that. I removed the debug and updated the resource.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

No labels
No labels

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions