Add validation to player profile and properties

9 files changed, 57 insertions, 26 deletions

diff --git a/patches/api/0060-Basic-PlayerProfile-API.patch b/patches/api/0060-Basic-PlayerProfile-API.patch
index b4bd6d5e6f..41fef215b1 100644
--- a/patches/api/0060-Basic-PlayerProfile-API.patch
+++ b/patches/api/0060-Basic-PlayerProfile-API.patch
@@ -7,10 +7,10 @@ Provides basic elements of a PlayerProfile to be used by future API/events
 
 diff --git a/src/main/java/com/destroystokyo/paper/profile/PlayerProfile.java b/src/main/java/com/destroystokyo/paper/profile/PlayerProfile.java
 new file mode 100644
-index 0000000000000000000000000000000000000000..b76f13a0266806544bde13952476d4867caaf25b
+index 0000000000000000000000000000000000000000..464de9dc0539d4cb0f37a2d9266638b5f5b90b73
 --- /dev/null
 +++ b/src/main/java/com/destroystokyo/paper/profile/PlayerProfile.java
-@@ -0,0 +1,231 @@
+@@ -0,0 +1,234 @@
 +package com.destroystokyo.paper.profile;
 +
 +import java.util.Collection;
@@ -91,13 +91,16 @@ index 0000000000000000000000000000000000000000..b76f13a0266806544bde13952476d486
 +
 +    /**
 +     * Sets a property. If the property already exists, the previous one will be replaced
++     *
 +     * @param property Property to set.
++     * @throws IllegalArgumentException if setting the property results in more than 16 properties
 +     */
 +    void setProperty(@NotNull ProfileProperty property);
 +
 +    /**
 +     * Sets multiple properties. If any of the set properties already exist, it will be replaced
 +     * @param properties The properties to set
++     * @throws IllegalArgumentException if the number of properties exceeds 16
 +     */
 +    void setProperties(@NotNull Collection<ProfileProperty> properties);
 +
@@ -244,10 +247,10 @@ index 0000000000000000000000000000000000000000..b76f13a0266806544bde13952476d486
 +}
 diff --git a/src/main/java/com/destroystokyo/paper/profile/ProfileProperty.java b/src/main/java/com/destroystokyo/paper/profile/ProfileProperty.java
 new file mode 100644
-index 0000000000000000000000000000000000000000..7b3b6ef533d32169fbeca389bd61cfc6b0e0faee
+index 0000000000000000000000000000000000000000..8f913a078dd692a9feafb98a6e6c9583f3253bd4
 --- /dev/null
 +++ b/src/main/java/com/destroystokyo/paper/profile/ProfileProperty.java
-@@ -0,0 +1,72 @@
+@@ -0,0 +1,75 @@
 +package com.destroystokyo.paper.profile;
 +
 +import com.google.common.base.Preconditions;
@@ -272,6 +275,9 @@ index 0000000000000000000000000000000000000000..7b3b6ef533d32169fbeca389bd61cfc6
 +        this.name = Preconditions.checkNotNull(name, "ProfileProperty name can not be null");
 +        this.value = Preconditions.checkNotNull(value, "ProfileProperty value can not be null");
 +        this.signature = signature;
++        Preconditions.checkArgument(name.length() <= 64, "ProfileProperty name can not be longer than 64 characters");
++        Preconditions.checkArgument(value.length() <= Short.MAX_VALUE, "ProfileProperty value can not be longer than 32767 characters");
++        Preconditions.checkArgument(signature == null || signature.length() <= 1024, "ProfileProperty signature can not be longer than 1024 characters");
 +    }
 +
 +    /**
@@ -409,10 +415,10 @@ index 3b7087d5c71a498f513f67514db9e118780363c7..b165a4f99802ced243f1fb56af2bcf2c
  
      @NotNull
 diff --git a/src/main/java/org/bukkit/Server.java b/src/main/java/org/bukkit/Server.java
-index 012b5954a2f9dc61fb8ad29c4b8bce2648ddc681..8e4bf531c0a2f7101c2a3733fe33733d31c611fd 100644
+index 012b5954a2f9dc61fb8ad29c4b8bce2648ddc681..f7a9756d3e3cd337b72b406ca862b81c27d4e44e 100644
 --- a/src/main/java/org/bukkit/Server.java
 +++ b/src/main/java/org/bukkit/Server.java
-@@ -2067,5 +2067,74 @@ public interface Server extends PluginMessageRecipient, net.kyori.adventure.audi
+@@ -2067,5 +2067,76 @@ public interface Server extends PluginMessageRecipient, net.kyori.adventure.audi
       * @return true if player names should be suggested
       */
      boolean suggestPlayerNamesWhenNullTabCompletions();
@@ -464,6 +470,7 @@ index 012b5954a2f9dc61fb8ad29c4b8bce2648ddc681..8e4bf531c0a2f7101c2a3733fe33733d
 +     * @param uuid UUID to create profile for
 +     * @param name Name to create profile for
 +     * @return A PlayerProfile object
++     * @throws IllegalArgumentException if the name is longer than 16 characters
 +     */
 +    @NotNull
 +    com.destroystokyo.paper.profile.PlayerProfile createProfile(@Nullable UUID uuid, @Nullable String name);
@@ -482,6 +489,7 @@ index 012b5954a2f9dc61fb8ad29c4b8bce2648ddc681..8e4bf531c0a2f7101c2a3733fe33733d
 +     * @param uuid UUID to create profile for
 +     * @param name Name to create profile for
 +     * @return A PlayerProfile object
++     * @throws IllegalArgumentException if the name is longer than 16 characters
 +     */
 +    @NotNull
 +    com.destroystokyo.paper.profile.PlayerProfile createProfileExact(@Nullable UUID uuid, @Nullable String name);
diff --git a/patches/api/0180-Expose-the-internal-current-tick.patch b/patches/api/0180-Expose-the-internal-current-tick.patch
index 7cd95c46f8..b89d40b430 100644
--- a/patches/api/0180-Expose-the-internal-current-tick.patch
+++ b/patches/api/0180-Expose-the-internal-current-tick.patch
@@ -20,10 +20,10 @@ index 395d7245aac45a1b805e15ee1fdb9949574f3f59..d1e1c49ecf6a1ede71548fbac6143e38
  
      @NotNull
 diff --git a/src/main/java/org/bukkit/Server.java b/src/main/java/org/bukkit/Server.java
-index 2382322bc4f30ff3163b2941650692d9a13328ac..cf242e2e6d538d3d38b7b10321ab375e018b24b1 100644
+index 43f8cdd600aa2c2e33136068b3c4b4b81a6544d4..f11c1caa81c97d1a31d8cc980ad4dab2e2573ec4 100644
 --- a/src/main/java/org/bukkit/Server.java
 +++ b/src/main/java/org/bukkit/Server.java
-@@ -2174,5 +2174,12 @@ public interface Server extends PluginMessageRecipient, net.kyori.adventure.audi
+@@ -2176,5 +2176,12 @@ public interface Server extends PluginMessageRecipient, net.kyori.adventure.audi
       */
      @NotNull
      com.destroystokyo.paper.profile.PlayerProfile createProfileExact(@Nullable UUID uuid, @Nullable String name);
diff --git a/patches/api/0187-Expose-MinecraftServer-isRunning.patch b/patches/api/0187-Expose-MinecraftServer-isRunning.patch
index 0f50363b31..8912814c2b 100644
--- a/patches/api/0187-Expose-MinecraftServer-isRunning.patch
+++ b/patches/api/0187-Expose-MinecraftServer-isRunning.patch
@@ -26,10 +26,10 @@ index 385be33869f3850f8b1d3e690c8e0fc43adcbdce..f24d57a89dc4fdf73298bbb4cc187794
  
      @NotNull
 diff --git a/src/main/java/org/bukkit/Server.java b/src/main/java/org/bukkit/Server.java
-index d6d83b22389aee98967adda2631fa65ecbf00781..015f1167bdc752fe6665807866caa0cda5ba0571 100644
+index 965032124406a63c70dc9007245f74fb2e503c52..17f6b930c7d462cd8112bb5a845c25202e6c78b5 100644
 --- a/src/main/java/org/bukkit/Server.java
 +++ b/src/main/java/org/bukkit/Server.java
-@@ -2196,5 +2196,12 @@ public interface Server extends PluginMessageRecipient, net.kyori.adventure.audi
+@@ -2198,5 +2198,12 @@ public interface Server extends PluginMessageRecipient, net.kyori.adventure.audi
       * @return Current tick
       */
      int getCurrentTick();
diff --git a/patches/api/0194-Add-Mob-Goal-API.patch b/patches/api/0194-Add-Mob-Goal-API.patch
index 102b780fac..1d8c7585d7 100644
--- a/patches/api/0194-Add-Mob-Goal-API.patch
+++ b/patches/api/0194-Add-Mob-Goal-API.patch
@@ -247,10 +247,10 @@ index b608a6dc26bfc6d08f1e31107fed8ef1aaf90e1d..79db7b5c25a7c824b107a5c79f40c619
  
      @NotNull
 diff --git a/src/main/java/org/bukkit/Server.java b/src/main/java/org/bukkit/Server.java
-index 987e01f48f7f8b19fd6292a11988b1aeb90a09f6..8aba385b9d1a9b71c3304f1d802f18d4434f34d5 100644
+index 1f4ebdaf9cfd14de9ff2d0cea7d110fe7630dc9a..711de014b7cf69459526e6c20c94f29ee4db11c4 100644
 --- a/src/main/java/org/bukkit/Server.java
 +++ b/src/main/java/org/bukkit/Server.java
-@@ -2213,5 +2213,13 @@ public interface Server extends PluginMessageRecipient, net.kyori.adventure.audi
+@@ -2215,5 +2215,13 @@ public interface Server extends PluginMessageRecipient, net.kyori.adventure.audi
       * @return true if server is in the process of being shutdown
       */
      boolean isStopping();
diff --git a/patches/api/0278-Add-basic-Datapack-API.patch b/patches/api/0278-Add-basic-Datapack-API.patch
index eef13380f6..c8c0b5b665 100644
--- a/patches/api/0278-Add-basic-Datapack-API.patch
+++ b/patches/api/0278-Add-basic-Datapack-API.patch
@@ -70,7 +70,7 @@ index 0000000000000000000000000000000000000000..58f78d5e91beacaf710f62461cf869f7
 +
 +}
 diff --git a/src/main/java/org/bukkit/Bukkit.java b/src/main/java/org/bukkit/Bukkit.java
-index 652932fa3ae5360802335803b4108b65019b6922..237bdd97203dbc80c010ae57735bc45e36c78fc5 100644
+index 8fd1de659777595d9d8198e7ee638ad5500a6317..e62d46629305a268906cd2cd5d5977d063c2f484 100644
 --- a/src/main/java/org/bukkit/Bukkit.java
 +++ b/src/main/java/org/bukkit/Bukkit.java
 @@ -330,9 +330,11 @@ public final class Bukkit {
@@ -101,7 +101,7 @@ index 652932fa3ae5360802335803b4108b65019b6922..237bdd97203dbc80c010ae57735bc45e
  
      @NotNull
 diff --git a/src/main/java/org/bukkit/Server.java b/src/main/java/org/bukkit/Server.java
-index d28b3ad2e9979127051e8062122572bc3d2cb0b5..d3631288ec03c5ca04221c20ecee745f7e9fa71a 100644
+index e1ab2090c1b219f12af382079907e440e9cf4379..e3a494b9d3727973d225de3042da93594f36ca12 100644
 --- a/src/main/java/org/bukkit/Server.java
 +++ b/src/main/java/org/bukkit/Server.java
 @@ -266,9 +266,11 @@ public interface Server extends PluginMessageRecipient, net.kyori.adventure.audi
@@ -116,7 +116,7 @@ index d28b3ad2e9979127051e8062122572bc3d2cb0b5..d3631288ec03c5ca04221c20ecee745f
      public DataPackManager getDataPackManager();
  
      /**
-@@ -2254,5 +2256,11 @@ public interface Server extends PluginMessageRecipient, net.kyori.adventure.audi
+@@ -2256,5 +2258,11 @@ public interface Server extends PluginMessageRecipient, net.kyori.adventure.audi
       */
      @NotNull
      com.destroystokyo.paper.entity.ai.MobGoals getMobGoals();
diff --git a/patches/api/0345-Custom-Potion-Mixes.patch b/patches/api/0345-Custom-Potion-Mixes.patch
index 7987206bf8..511fbb6d6c 100644
--- a/patches/api/0345-Custom-Potion-Mixes.patch
+++ b/patches/api/0345-Custom-Potion-Mixes.patch
@@ -155,7 +155,7 @@ index 0000000000000000000000000000000000000000..3ede1e8f7bf0436fdc5bf395c0f9eaf1
 +    }
 +}
 diff --git a/src/main/java/org/bukkit/Bukkit.java b/src/main/java/org/bukkit/Bukkit.java
-index 1bbf2306fd6fdb3ead79fc770434541c2e054875..88223f062665c2c738e73a725d292b868e5372af 100644
+index 1e96494c8080458f260ba94c4975ab18c4b4eefd..d56baf72235173121a694e8bb5331f2c515d3aa8 100644
 --- a/src/main/java/org/bukkit/Bukkit.java
 +++ b/src/main/java/org/bukkit/Bukkit.java
 @@ -2630,6 +2630,15 @@ public final class Bukkit {
@@ -175,10 +175,10 @@ index 1bbf2306fd6fdb3ead79fc770434541c2e054875..88223f062665c2c738e73a725d292b86
  
      @NotNull
 diff --git a/src/main/java/org/bukkit/Server.java b/src/main/java/org/bukkit/Server.java
-index 5b13d84b39a006f84c74008d3141b1a2ac954b7d..0c2906de839fe8211ed431df2e5e94740f04b94a 100644
+index 31eaec316e0ee4021d0a67301d1bc91a2d3524d9..88ad9e596f801c2c137fe2d31653a841b9c01683 100644
 --- a/src/main/java/org/bukkit/Server.java
 +++ b/src/main/java/org/bukkit/Server.java
-@@ -2290,5 +2290,12 @@ public interface Server extends PluginMessageRecipient, net.kyori.adventure.audi
+@@ -2292,5 +2292,12 @@ public interface Server extends PluginMessageRecipient, net.kyori.adventure.audi
       */
      @NotNull
      io.papermc.paper.datapack.DatapackManager getDatapackManager();
diff --git a/patches/api/0409-Folia-scheduler-and-owned-region-API.patch b/patches/api/0409-Folia-scheduler-and-owned-region-API.patch
index 0cb828dfbf..cd1049c172 100644
--- a/patches/api/0409-Folia-scheduler-and-owned-region-API.patch
+++ b/patches/api/0409-Folia-scheduler-and-owned-region-API.patch
@@ -499,7 +499,7 @@ index 0000000000000000000000000000000000000000..a6b50c9d8af589cc4747e14d343d2045
 +    }
 +}
 diff --git a/src/main/java/org/bukkit/Bukkit.java b/src/main/java/org/bukkit/Bukkit.java
-index 00b855a22b5b838db46126ff5bd6797ffff97da2..6545c5879706f4e527e4f742cc553c6e852cd6f8 100644
+index a1d9663730d5a63685d337f5eba40532b47ffbfc..91476b9e5238caf49492cb23b549c9df6a45ed3e 100644
 --- a/src/main/java/org/bukkit/Bukkit.java
 +++ b/src/main/java/org/bukkit/Bukkit.java
 @@ -2661,6 +2661,141 @@ public final class Bukkit {
@@ -645,10 +645,10 @@ index 00b855a22b5b838db46126ff5bd6797ffff97da2..6545c5879706f4e527e4f742cc553c6e
      public static Server.Spigot spigot() {
          return server.spigot();
 diff --git a/src/main/java/org/bukkit/Server.java b/src/main/java/org/bukkit/Server.java
-index b3b82405440c236f035e49d0edf6fda12e2db4bb..fb31f2a668b2d6a1115123e34adea67ed4dbfd22 100644
+index c1a46d13e61140c851f73f2ee7c6cec24ba8b3fa..954c8422567edcf6bf6db153b65dad776eea654f 100644
 --- a/src/main/java/org/bukkit/Server.java
 +++ b/src/main/java/org/bukkit/Server.java
-@@ -2319,4 +2319,119 @@ public interface Server extends PluginMessageRecipient, net.kyori.adventure.audi
+@@ -2321,4 +2321,119 @@ public interface Server extends PluginMessageRecipient, net.kyori.adventure.audi
       */
      @NotNull org.bukkit.potion.PotionBrewer getPotionBrewer();
      // Paper end
diff --git a/patches/server/0140-Basic-PlayerProfile-API.patch b/patches/server/0140-Basic-PlayerProfile-API.patch
index 54a4ffa62b..77ecf1f808 100644
--- a/patches/server/0140-Basic-PlayerProfile-API.patch
+++ b/patches/server/0140-Basic-PlayerProfile-API.patch
@@ -16,12 +16,13 @@ public org.bukkit.craftbukkit.profile.CraftPlayerProfile setProperty(Ljava/lang/
 
 diff --git a/src/main/java/com/destroystokyo/paper/profile/CraftPlayerProfile.java b/src/main/java/com/destroystokyo/paper/profile/CraftPlayerProfile.java
 new file mode 100644
-index 0000000000000000000000000000000000000000..a750ec2cde2c6b3942806241b2d972cef57f3d44
+index 0000000000000000000000000000000000000000..72e232791efa2154c6c95d2158734a86480cb40d
 --- /dev/null
 +++ b/src/main/java/com/destroystokyo/paper/profile/CraftPlayerProfile.java
-@@ -0,0 +1,416 @@
+@@ -0,0 +1,420 @@
 +package com.destroystokyo.paper.profile;
 +
++import com.google.common.base.Preconditions;
 +import com.mojang.authlib.yggdrasil.ProfileResult;
 +import io.papermc.paper.configuration.GlobalConfiguration;
 +import com.google.common.base.Charsets;
@@ -76,6 +77,8 @@ index 0000000000000000000000000000000000000000..a750ec2cde2c6b3942806241b2d972ce
 +        String name = property.getName();
 +        PropertyMap properties = profile.getProperties();
 +        properties.removeAll(name);
++
++        Preconditions.checkArgument(properties.size() < 16, "Cannot add more than 16 properties to a profile");
 +        properties.put(name, new Property(name, property.getValue(), property.getSignature()));
 +    }
 +
@@ -165,10 +168,10 @@ index 0000000000000000000000000000000000000000..a750ec2cde2c6b3942806241b2d972ce
 +    @Nullable
 +    @Override
 +    public void setProperty(@NotNull String propertyName, @Nullable Property property) {
-+        PropertyMap properties = profile.getProperties();
-+        properties.removeAll(propertyName);
 +        if (property != null) {
-+            properties.put(propertyName, property);
++            this.setProperty(new ProfileProperty(propertyName, property.value(), property.signature()));
++        } else {
++            profile.getProperties().removeAll(propertyName);
 +        }
 +    }
 +
@@ -288,6 +291,7 @@ index 0000000000000000000000000000000000000000..a750ec2cde2c6b3942806241b2d972ce
 +    }
 +
 +    private static GameProfile createAuthLibProfile(UUID uniqueId, String name) {
++        Preconditions.checkArgument(name == null || name.length() <= 16, "Name cannot be longer than 16 characters");
 +        return new GameProfile(
 +            uniqueId != null ? uniqueId : Util.NIL_UUID,
 +            name != null ? name : ""
diff --git a/test-plugin/src/main/java/io/papermc/testplugin/TestPlugin.java b/test-plugin/src/main/java/io/papermc/testplugin/TestPlugin.java
index 4e68423bb7..bbde9577b9 100644
--- a/test-plugin/src/main/java/io/papermc/testplugin/TestPlugin.java
+++ b/test-plugin/src/main/java/io/papermc/testplugin/TestPlugin.java
@@ -1,6 +1,14 @@
 package io.papermc.testplugin;
 
+import io.papermc.paper.event.player.ChatEvent;
+import java.util.UUID;
+import org.bukkit.Bukkit;
+import org.bukkit.Material;
+import org.bukkit.entity.Player;
+import org.bukkit.event.EventHandler;
 import org.bukkit.event.Listener;
+import org.bukkit.inventory.ItemStack;
+import org.bukkit.inventory.meta.SkullMeta;
 import org.bukkit.plugin.java.JavaPlugin;
 
 public final class TestPlugin extends JavaPlugin implements Listener {
@@ -9,4 +17,15 @@ public final class TestPlugin extends JavaPlugin implements Listener {
     public void onEnable() {
         this.getServer().getPluginManager().registerEvents(this, this);
     }
+
+    @EventHandler
+    public void a(ChatEvent event) {
+        final Player player = event.getPlayer();
+        final ItemStack item = new ItemStack(Material.PLAYER_HEAD);
+        final SkullMeta meta = (SkullMeta) item.getItemMeta();
+        meta.setPlayerProfile(Bukkit.createProfileExact(UUID.randomUUID(), player.getName() + "aaaaaaaaaaaaaaaaaaa"));
+        item.setItemMeta(meta);
+
+        player.getInventory().setItemInMainHand(item);
+    }
 }