Add validation to player profile and properties (#10680)

patches/api/0060-Basic-PlayerProfile-API.patch

@@ -7,10 +7,10 @@ Provides basic elements of a PlayerProfile to be used by future API/events
 
 diff --git a/src/main/java/com/destroystokyo/paper/profile/PlayerProfile.java b/src/main/java/com/destroystokyo/paper/profile/PlayerProfile.java
 new file mode 100644
-index 0000000000000000000000000000000000000000..b76f13a0266806544bde13952476d4867caaf25b
+index 0000000000000000000000000000000000000000..464de9dc0539d4cb0f37a2d9266638b5f5b90b73
 --- /dev/null
 +++ b/src/main/java/com/destroystokyo/paper/profile/PlayerProfile.java
-@@ -0,0 +1,231 @@
+@@ -0,0 +1,234 @@
 +package com.destroystokyo.paper.profile;
 +
 +import java.util.Collection;
@@ -91,13 +91,16 @@ index 0000000000000000000000000000000000000000..b76f13a0266806544bde13952476d486
 +
 +    /**
 +     * Sets a property. If the property already exists, the previous one will be replaced
++     *
 +     * @param property Property to set.
++     * @throws IllegalArgumentException if setting the property results in more than 16 properties
 +     */
 +    void setProperty(@NotNull ProfileProperty property);
 +
 +    /**
 +     * Sets multiple properties. If any of the set properties already exist, it will be replaced
 +     * @param properties The properties to set
++     * @throws IllegalArgumentException if the number of properties exceeds 16
 +     */
 +    void setProperties(@NotNull Collection<ProfileProperty> properties);
 +
@@ -244,10 +247,10 @@ index 0000000000000000000000000000000000000000..b76f13a0266806544bde13952476d486
 +}
 diff --git a/src/main/java/com/destroystokyo/paper/profile/ProfileProperty.java b/src/main/java/com/destroystokyo/paper/profile/ProfileProperty.java
 new file mode 100644
-index 0000000000000000000000000000000000000000..7b3b6ef533d32169fbeca389bd61cfc6b0e0faee
+index 0000000000000000000000000000000000000000..8f913a078dd692a9feafb98a6e6c9583f3253bd4
 --- /dev/null
 +++ b/src/main/java/com/destroystokyo/paper/profile/ProfileProperty.java
-@@ -0,0 +1,72 @@
+@@ -0,0 +1,75 @@
 +package com.destroystokyo.paper.profile;
 +
 +import com.google.common.base.Preconditions;
@@ -272,6 +275,9 @@ index 0000000000000000000000000000000000000000..7b3b6ef533d32169fbeca389bd61cfc6
 +        this.name = Preconditions.checkNotNull(name, "ProfileProperty name can not be null");
 +        this.value = Preconditions.checkNotNull(value, "ProfileProperty value can not be null");
 +        this.signature = signature;
++        Preconditions.checkArgument(name.length() <= 64, "ProfileProperty name can not be longer than 64 characters");
++        Preconditions.checkArgument(value.length() <= Short.MAX_VALUE, "ProfileProperty value can not be longer than 32767 characters");
++        Preconditions.checkArgument(signature == null || signature.length() <= 1024, "ProfileProperty signature can not be longer than 1024 characters");
 +    }
 +
 +    /**
@@ -409,10 +415,10 @@ index 3b7087d5c71a498f513f67514db9e118780363c7..b165a4f99802ced243f1fb56af2bcf2c
 
      @NotNull
 diff --git a/src/main/java/org/bukkit/Server.java b/src/main/java/org/bukkit/Server.java
-index 012b5954a2f9dc61fb8ad29c4b8bce2648ddc681..8e4bf531c0a2f7101c2a3733fe33733d31c611fd 100644
+index 012b5954a2f9dc61fb8ad29c4b8bce2648ddc681..f7a9756d3e3cd337b72b406ca862b81c27d4e44e 100644
 --- a/src/main/java/org/bukkit/Server.java
 +++ b/src/main/java/org/bukkit/Server.java
-@@ -2067,5 +2067,74 @@ public interface Server extends PluginMessageRecipient, net.kyori.adventure.audi
+@@ -2067,5 +2067,76 @@ public interface Server extends PluginMessageRecipient, net.kyori.adventure.audi
       * @return true if player names should be suggested
       */
      boolean suggestPlayerNamesWhenNullTabCompletions();
@@ -464,6 +470,7 @@ index 012b5954a2f9dc61fb8ad29c4b8bce2648ddc681..8e4bf531c0a2f7101c2a3733fe33733d
 +     * @param uuid UUID to create profile for
 +     * @param name Name to create profile for
 +     * @return A PlayerProfile object
++     * @throws IllegalArgumentException if the name is longer than 16 characters
 +     */
 +    @NotNull
 +    com.destroystokyo.paper.profile.PlayerProfile createProfile(@Nullable UUID uuid, @Nullable String name);
@@ -482,6 +489,7 @@ index 012b5954a2f9dc61fb8ad29c4b8bce2648ddc681..8e4bf531c0a2f7101c2a3733fe33733d
 +     * @param uuid UUID to create profile for
 +     * @param name Name to create profile for
 +     * @return A PlayerProfile object
++     * @throws IllegalArgumentException if the name is longer than 16 characters
 +     */
 +    @NotNull
 +    com.destroystokyo.paper.profile.PlayerProfile createProfileExact(@Nullable UUID uuid, @Nullable String name);

patches/api/0180-Expose-the-internal-current-tick.patch

@@ -20,10 +20,10 @@ index 395d7245aac45a1b805e15ee1fdb9949574f3f59..d1e1c49ecf6a1ede71548fbac6143e38
 
      @NotNull
 diff --git a/src/main/java/org/bukkit/Server.java b/src/main/java/org/bukkit/Server.java
-index 2382322bc4f30ff3163b2941650692d9a13328ac..cf242e2e6d538d3d38b7b10321ab375e018b24b1 100644
+index 43f8cdd600aa2c2e33136068b3c4b4b81a6544d4..f11c1caa81c97d1a31d8cc980ad4dab2e2573ec4 100644
 --- a/src/main/java/org/bukkit/Server.java
 +++ b/src/main/java/org/bukkit/Server.java
-@@ -2174,5 +2174,12 @@ public interface Server extends PluginMessageRecipient, net.kyori.adventure.audi
+@@ -2176,5 +2176,12 @@ public interface Server extends PluginMessageRecipient, net.kyori.adventure.audi
       */
      @NotNull
      com.destroystokyo.paper.profile.PlayerProfile createProfileExact(@Nullable UUID uuid, @Nullable String name);

patches/api/0187-Expose-MinecraftServer-isRunning.patch

@@ -26,10 +26,10 @@ index 385be33869f3850f8b1d3e690c8e0fc43adcbdce..f24d57a89dc4fdf73298bbb4cc187794
 
      @NotNull
 diff --git a/src/main/java/org/bukkit/Server.java b/src/main/java/org/bukkit/Server.java
-index d6d83b22389aee98967adda2631fa65ecbf00781..015f1167bdc752fe6665807866caa0cda5ba0571 100644
+index 965032124406a63c70dc9007245f74fb2e503c52..17f6b930c7d462cd8112bb5a845c25202e6c78b5 100644
 --- a/src/main/java/org/bukkit/Server.java
 +++ b/src/main/java/org/bukkit/Server.java
-@@ -2196,5 +2196,12 @@ public interface Server extends PluginMessageRecipient, net.kyori.adventure.audi
+@@ -2198,5 +2198,12 @@ public interface Server extends PluginMessageRecipient, net.kyori.adventure.audi
       * @return Current tick
       */
      int getCurrentTick();

patches/api/0194-Add-Mob-Goal-API.patch

@@ -247,10 +247,10 @@ index b608a6dc26bfc6d08f1e31107fed8ef1aaf90e1d..79db7b5c25a7c824b107a5c79f40c619
 
      @NotNull
 diff --git a/src/main/java/org/bukkit/Server.java b/src/main/java/org/bukkit/Server.java
-index 987e01f48f7f8b19fd6292a11988b1aeb90a09f6..8aba385b9d1a9b71c3304f1d802f18d4434f34d5 100644
+index 1f4ebdaf9cfd14de9ff2d0cea7d110fe7630dc9a..711de014b7cf69459526e6c20c94f29ee4db11c4 100644
 --- a/src/main/java/org/bukkit/Server.java
 +++ b/src/main/java/org/bukkit/Server.java
-@@ -2213,5 +2213,13 @@ public interface Server extends PluginMessageRecipient, net.kyori.adventure.audi
+@@ -2215,5 +2215,13 @@ public interface Server extends PluginMessageRecipient, net.kyori.adventure.audi
       * @return true if server is in the process of being shutdown
       */
      boolean isStopping();

patches/api/0278-Add-basic-Datapack-API.patch

@@ -70,7 +70,7 @@ index 0000000000000000000000000000000000000000..58f78d5e91beacaf710f62461cf869f7
 +
 +}
 diff --git a/src/main/java/org/bukkit/Bukkit.java b/src/main/java/org/bukkit/Bukkit.java
-index 652932fa3ae5360802335803b4108b65019b6922..237bdd97203dbc80c010ae57735bc45e36c78fc5 100644
+index 8fd1de659777595d9d8198e7ee638ad5500a6317..e62d46629305a268906cd2cd5d5977d063c2f484 100644
 --- a/src/main/java/org/bukkit/Bukkit.java
 +++ b/src/main/java/org/bukkit/Bukkit.java
 @@ -330,9 +330,11 @@ public final class Bukkit {
@@ -101,7 +101,7 @@ index 652932fa3ae5360802335803b4108b65019b6922..237bdd97203dbc80c010ae57735bc45e
 
      @NotNull
 diff --git a/src/main/java/org/bukkit/Server.java b/src/main/java/org/bukkit/Server.java
-index d28b3ad2e9979127051e8062122572bc3d2cb0b5..d3631288ec03c5ca04221c20ecee745f7e9fa71a 100644
+index e1ab2090c1b219f12af382079907e440e9cf4379..e3a494b9d3727973d225de3042da93594f36ca12 100644
 --- a/src/main/java/org/bukkit/Server.java
 +++ b/src/main/java/org/bukkit/Server.java
 @@ -266,9 +266,11 @@ public interface Server extends PluginMessageRecipient, net.kyori.adventure.audi
@@ -116,7 +116,7 @@ index d28b3ad2e9979127051e8062122572bc3d2cb0b5..d3631288ec03c5ca04221c20ecee745f
      public DataPackManager getDataPackManager();
 
      /**
-@@ -2254,5 +2256,11 @@ public interface Server extends PluginMessageRecipient, net.kyori.adventure.audi
+@@ -2256,5 +2258,11 @@ public interface Server extends PluginMessageRecipient, net.kyori.adventure.audi
       */
      @NotNull
      com.destroystokyo.paper.entity.ai.MobGoals getMobGoals();

patches/api/0345-Custom-Potion-Mixes.patch

@@ -155,7 +155,7 @@ index 0000000000000000000000000000000000000000..3ede1e8f7bf0436fdc5bf395c0f9eaf1
 +    }
 +}
 diff --git a/src/main/java/org/bukkit/Bukkit.java b/src/main/java/org/bukkit/Bukkit.java
-index 1bbf2306fd6fdb3ead79fc770434541c2e054875..88223f062665c2c738e73a725d292b868e5372af 100644
+index 1e96494c8080458f260ba94c4975ab18c4b4eefd..d56baf72235173121a694e8bb5331f2c515d3aa8 100644
 --- a/src/main/java/org/bukkit/Bukkit.java
 +++ b/src/main/java/org/bukkit/Bukkit.java
 @@ -2630,6 +2630,15 @@ public final class Bukkit {
@@ -175,10 +175,10 @@ index 1bbf2306fd6fdb3ead79fc770434541c2e054875..88223f062665c2c738e73a725d292b86
 
      @NotNull
 diff --git a/src/main/java/org/bukkit/Server.java b/src/main/java/org/bukkit/Server.java
-index 5b13d84b39a006f84c74008d3141b1a2ac954b7d..0c2906de839fe8211ed431df2e5e94740f04b94a 100644
+index 31eaec316e0ee4021d0a67301d1bc91a2d3524d9..88ad9e596f801c2c137fe2d31653a841b9c01683 100644
 --- a/src/main/java/org/bukkit/Server.java
 +++ b/src/main/java/org/bukkit/Server.java
-@@ -2290,5 +2290,12 @@ public interface Server extends PluginMessageRecipient, net.kyori.adventure.audi
+@@ -2292,5 +2292,12 @@ public interface Server extends PluginMessageRecipient, net.kyori.adventure.audi
       */
      @NotNull
      io.papermc.paper.datapack.DatapackManager getDatapackManager();

patches/api/0409-Folia-scheduler-and-owned-region-API.patch

@@ -499,7 +499,7 @@ index 0000000000000000000000000000000000000000..a6b50c9d8af589cc4747e14d343d2045
 +    }
 +}
 diff --git a/src/main/java/org/bukkit/Bukkit.java b/src/main/java/org/bukkit/Bukkit.java
-index 00b855a22b5b838db46126ff5bd6797ffff97da2..6545c5879706f4e527e4f742cc553c6e852cd6f8 100644
+index a1d9663730d5a63685d337f5eba40532b47ffbfc..91476b9e5238caf49492cb23b549c9df6a45ed3e 100644
 --- a/src/main/java/org/bukkit/Bukkit.java
 +++ b/src/main/java/org/bukkit/Bukkit.java
 @@ -2661,6 +2661,141 @@ public final class Bukkit {
@@ -645,10 +645,10 @@ index 00b855a22b5b838db46126ff5bd6797ffff97da2..6545c5879706f4e527e4f742cc553c6e
      public static Server.Spigot spigot() {
          return server.spigot();
 diff --git a/src/main/java/org/bukkit/Server.java b/src/main/java/org/bukkit/Server.java
-index b3b82405440c236f035e49d0edf6fda12e2db4bb..fb31f2a668b2d6a1115123e34adea67ed4dbfd22 100644
+index c1a46d13e61140c851f73f2ee7c6cec24ba8b3fa..954c8422567edcf6bf6db153b65dad776eea654f 100644
 --- a/src/main/java/org/bukkit/Server.java
 +++ b/src/main/java/org/bukkit/Server.java
-@@ -2319,4 +2319,119 @@ public interface Server extends PluginMessageRecipient, net.kyori.adventure.audi
+@@ -2321,4 +2321,119 @@ public interface Server extends PluginMessageRecipient, net.kyori.adventure.audi
       */
      @NotNull org.bukkit.potion.PotionBrewer getPotionBrewer();
      // Paper end

patches/server/0074-Handle-Item-Meta-Inconsistencies.patch

@@ -271,3 +271,40 @@ index 3f309c255097f6778854d710a5a045fa960a953f..c318552a2ac2710cea01ac449a469a0f
 +    // Paper end
 +
  }
+diff --git a/src/main/java/org/bukkit/craftbukkit/profile/CraftPlayerProfile.java b/src/main/java/org/bukkit/craftbukkit/profile/CraftPlayerProfile.java
+index 358af0121ce3d87a9f51da2bae0699034c1560b4..44174c5a7b255af489c1e4bf589299e6bdbb90a3 100644
+--- a/src/main/java/org/bukkit/craftbukkit/profile/CraftPlayerProfile.java
++++ b/src/main/java/org/bukkit/craftbukkit/profile/CraftPlayerProfile.java
+@@ -37,6 +37,16 @@ public final class CraftPlayerProfile implements PlayerProfile {
+         boolean isValidSkullProfile = (gameProfile.getName() != null)
+                 || gameProfile.getProperties().containsKey(CraftPlayerTextures.PROPERTY_NAME);
+         Preconditions.checkArgument(isValidSkullProfile, "The skull profile is missing a name or textures!");
++        // Paper start - Validate
++        Preconditions.checkArgument(gameProfile.getName().length() <= 16, "The name of the profile is longer than 16 characters");
++        final PropertyMap properties = gameProfile.getProperties();
++        Preconditions.checkArgument(properties.size() <= 16, "The profile contains more than 16 properties");
++        for (final Property property : properties.values()) {
++            Preconditions.checkArgument(property.name().length() <= 64, "The name of a property is longer than 64 characters");
++            Preconditions.checkArgument(property.value().length() <= Short.MAX_VALUE, "The value of a property is longer than 32767 characters");
++            Preconditions.checkArgument(property.signature() == null || property.signature().length() <= 1024, "The signature of a property is longer than 1024 characters");
++        }
++        // Paper end - Validate
+         return gameProfile;
+     }
+
+@@ -53,6 +63,7 @@ public final class CraftPlayerProfile implements PlayerProfile {
+
+     public CraftPlayerProfile(UUID uniqueId, String name) {
+         Preconditions.checkArgument((uniqueId != null) || !StringUtils.isBlank(name), "uniqueId is null or name is blank");
++        Preconditions.checkArgument(name == null || name.length() <= 16, "The name of the profile is longer than 16 characters"); // Paper - Validate
+         this.uniqueId = (uniqueId == null) ? Util.NIL_UUID : uniqueId;
+         this.name = (name == null) ? "" : name;
+     }
+@@ -89,6 +100,7 @@ public final class CraftPlayerProfile implements PlayerProfile {
+         // Assert: (property == null) || property.getName().equals(propertyName)
+         this.removeProperty(propertyName);
+         if (property != null) {
++            Preconditions.checkArgument(this.properties.size() < 16, "The profile contains more than 16 properties"); // Paper - Validate
+             this.properties.put(property.name(), property);
+         }
+     }

patches/server/0139-Do-not-submit-profile-lookups-to-worldgen-threads.patch

@@ -63,10 +63,10 @@ index 6097e0ab387cfa4c2c9ab0389fc5bb6cd899ecc3..ebba6bc5b337d19e32be5a78294501ed
 
      public static void clear() {
 diff --git a/src/main/java/org/bukkit/craftbukkit/profile/CraftPlayerProfile.java b/src/main/java/org/bukkit/craftbukkit/profile/CraftPlayerProfile.java
-index 358af0121ce3d87a9f51da2bae0699034c1560b4..edd340c66ea8cec1c76ba29f1deab14c4784a7e5 100644
+index 866f9d00669923ee01ac97399cd78b5ee58f950f..6f0edd4d1c473179c03253326a3c7b5910ec53ad 100644
 --- a/src/main/java/org/bukkit/craftbukkit/profile/CraftPlayerProfile.java
 +++ b/src/main/java/org/bukkit/craftbukkit/profile/CraftPlayerProfile.java
-@@ -122,7 +122,7 @@ public final class CraftPlayerProfile implements PlayerProfile {
+@@ -134,7 +134,7 @@ public final class CraftPlayerProfile implements PlayerProfile {
 
      @Override
      public CompletableFuture<PlayerProfile> update() {

patches/server/0140-Basic-PlayerProfile-API.patch

@@ -16,12 +16,13 @@ public org.bukkit.craftbukkit.profile.CraftPlayerProfile setProperty(Ljava/lang/
 
 diff --git a/src/main/java/com/destroystokyo/paper/profile/CraftPlayerProfile.java b/src/main/java/com/destroystokyo/paper/profile/CraftPlayerProfile.java
 new file mode 100644
-index 0000000000000000000000000000000000000000..a750ec2cde2c6b3942806241b2d972cef57f3d44
+index 0000000000000000000000000000000000000000..72e232791efa2154c6c95d2158734a86480cb40d
 --- /dev/null
 +++ b/src/main/java/com/destroystokyo/paper/profile/CraftPlayerProfile.java
-@@ -0,0 +1,416 @@
+@@ -0,0 +1,420 @@
 +package com.destroystokyo.paper.profile;
 +
++import com.google.common.base.Preconditions;
 +import com.mojang.authlib.yggdrasil.ProfileResult;
 +import io.papermc.paper.configuration.GlobalConfiguration;
 +import com.google.common.base.Charsets;
@@ -76,6 +77,8 @@ index 0000000000000000000000000000000000000000..a750ec2cde2c6b3942806241b2d972ce
 +        String name = property.getName();
 +        PropertyMap properties = profile.getProperties();
 +        properties.removeAll(name);
++
++        Preconditions.checkArgument(properties.size() < 16, "Cannot add more than 16 properties to a profile");
 +        properties.put(name, new Property(name, property.getValue(), property.getSignature()));
 +    }
 +
@@ -165,10 +168,10 @@ index 0000000000000000000000000000000000000000..a750ec2cde2c6b3942806241b2d972ce
 +    @Nullable
 +    @Override
 +    public void setProperty(@NotNull String propertyName, @Nullable Property property) {
-+        PropertyMap properties = profile.getProperties();
-+        properties.removeAll(propertyName);
 +        if (property != null) {
-+            properties.put(propertyName, property);
++            this.setProperty(new ProfileProperty(propertyName, property.value(), property.signature()));
++        } else {
++            profile.getProperties().removeAll(propertyName);
 +        }
 +    }
 +
@@ -288,6 +291,7 @@ index 0000000000000000000000000000000000000000..a750ec2cde2c6b3942806241b2d972ce
 +    }
 +
 +    private static GameProfile createAuthLibProfile(UUID uniqueId, String name) {
++        Preconditions.checkArgument(name == null || name.length() <= 16, "Name cannot be longer than 16 characters");
 +        return new GameProfile(
 +            uniqueId != null ? uniqueId : Util.NIL_UUID,
 +            name != null ? name : ""
@@ -684,7 +688,7 @@ index f6012feafe1dbbf9c52ac38965d9475896766657..a7554f2028f93867360c27a51c9580a8
      // Paper end
  }
 diff --git a/src/main/java/org/bukkit/craftbukkit/profile/CraftPlayerProfile.java b/src/main/java/org/bukkit/craftbukkit/profile/CraftPlayerProfile.java
-index edd340c66ea8cec1c76ba29f1deab14c4784a7e5..6f779c6f4422c5b5dc22f66e3e702c714d0e052b 100644
+index 6f0edd4d1c473179c03253326a3c7b5910ec53ad..e3a244dac35bf4d5d10e41c200aaa7f93e278ef9 100644
 --- a/src/main/java/org/bukkit/craftbukkit/profile/CraftPlayerProfile.java
 +++ b/src/main/java/org/bukkit/craftbukkit/profile/CraftPlayerProfile.java
 @@ -28,7 +28,7 @@ import org.bukkit.profile.PlayerProfile;
@@ -696,7 +700,7 @@ index edd340c66ea8cec1c76ba29f1deab14c4784a7e5..6f779c6f4422c5b5dc22f66e3e702c71
 
      @Nonnull
      public static GameProfile validateSkullProfile(@Nonnull GameProfile gameProfile) {
-@@ -93,8 +93,10 @@ public final class CraftPlayerProfile implements PlayerProfile {
+@@ -105,8 +105,10 @@ public final class CraftPlayerProfile implements PlayerProfile {
          }
      }
 
@@ -709,15 +713,15 @@ index edd340c66ea8cec1c76ba29f1deab14c4784a7e5..6f779c6f4422c5b5dc22f66e3e702c71
      }
 
      void rebuildDirtyProperties() {
-@@ -237,6 +239,7 @@ public final class CraftPlayerProfile implements PlayerProfile {
+@@ -249,6 +251,7 @@ public final class CraftPlayerProfile implements PlayerProfile {
 
      @Override
      public Map<String, Object> serialize() {
 +        // Paper - diff on change
          Map<String, Object> map = new LinkedHashMap<>();
          if (this.getUniqueId() != null) {
              map.put("uniqueId", this.getUniqueId().toString());
-@@ -252,10 +255,12 @@ public final class CraftPlayerProfile implements PlayerProfile {
+@@ -264,10 +267,12 @@ public final class CraftPlayerProfile implements PlayerProfile {
              });
              map.put("properties", propertiesData);
          }
@@ -730,7 +734,7 @@ index edd340c66ea8cec1c76ba29f1deab14c4784a7e5..6f779c6f4422c5b5dc22f66e3e702c71
          UUID uniqueId = ConfigSerializationUtil.getUuid(map, "uniqueId", true);
          String name = ConfigSerializationUtil.getString(map, "name", true);
 
-@@ -269,7 +274,7 @@ public final class CraftPlayerProfile implements PlayerProfile {
+@@ -281,7 +286,7 @@ public final class CraftPlayerProfile implements PlayerProfile {
                  profile.properties.put(property.name(), property);
              }
          }