Item icons from Mojang's client jar, not a CDN (#127) - #148
Merged
Conversation
The Players tab hot-linked `assets.mcasset.cloud` for every inventory slot. Three things wrong with that, and the reported symptom was the third: a third party in the middle of a private server's inventory, a grid of broken images on an air-gapped LAN, and — the one an operator actually sees — most items rendering as a three-letter text chip. That last one is not a network problem. The component asked for `item/<id>.png` and then `block/<id>.png` and gave up. Minecraft does not name textures that way: `grass_block` has only `_top` and `_side`, a furnace is `_front`, a log's inventory face is `_top`. Every one of those fell through to the chip whether or not the CDN answered. So the candidate list is the fix, and it is pure and tested: `textureCandidates` tries the item folder, then the block folder, then the faces, plus a short alias table for the handful whose texture shares no prefix with the id at all. Textures now come out of the client jar Mojang publishes for every version. MSMS already downloads and sha1-verifies jars from that same manifest, so this adds no new trust and no new dependency — `downloads. client` is the sibling of the `downloads.server` key `versions.ts` already reads. Measured on 1.21.4 rather than guessed: a 27 MB download, sha1 verified, of which 644 item and 1039 block textures are kept — 0.4 MB on disk. One download per Minecraft version, shared by every server on it, behind a button rather than automatic, because 27 MB is not a thing to spend on somebody's behalf. Nothing here is required for the app to work. With no assets downloaded the lookup answers null and the inventory draws the chips it drew before. Two things the smoke pins down. An id from hand-edited NBT must not become a path — `../../etc/passwd`, `a/b`, `..` and friends produce no candidates at all, which is the only thing between a crafted inventory entry and the cache directory. And the extractor's filter keeps exactly the two folders: an entity texture, an `.mcmeta`, a lang file and a nested path are all refused. This is half of #127. The other half — block map colours averaged from the same textures instead of the hand-written table — needs a PNG decoder and touches the renderer that took this session to stabilise, so it lands separately. Verified: 12/12 gates.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Half of #127 — the half that was reported.
The reported symptom was not a network problem
The Players tab hot-linked
assets.mcasset.cloud, asked foritem/<id>.png, thenblock/<id>.png, and gave up. Minecraft does not name textures that way:grass_blockhas only_topand_side, a furnace is_front, a log's inventory face is_top. Every one of those fell through to a three-letter text chip whether or not the CDN answered.So the candidate list is the actual fix, and it is pure and tested. The CDN removal is what the issue was opened for.
Where the pictures come from now
The client jar Mojang publishes for every version. MSMS already downloads and sha1-verifies jars from that same manifest, so this adds no new trust and no new dependency —
downloads.clientis the sibling of thedownloads.serverkeyversions.tsalready reads.Measured on 1.21.4, not guessed:
One download per Minecraft version, shared by every server on it, behind a button rather than automatic — 27 MB is not a thing to spend on somebody's behalf. Concurrent callers share one in-flight promise rather than racing two downloads into the same directory.
Nothing here is required for the app to work: with no assets downloaded the lookup answers
nulland the inventory draws the chips it drew before.What the smoke pins down
../../etc/passwd,a/b,..,a band an 80-character id all produce no candidates at all — the only thing between a crafted inventory entry and the cache directory..mcmeta, a lang file and a nested path are all refused.1.21.4-pre2→1.21.4,1.20.1-forge-47.2.0→1.20.1, nonsense →''and no exception.grass_blockfound viablock/grass_block_side, not by exact name.Still open on #127
Block map colours averaged from these same textures, replacing the hand-written table in
regionFormat.ts. That needs a PNG decoder and touches the renderer this session spent its time stabilising, so it lands as its own PR rather than riding along with this one.12/12 gates.