some sort of creative exploit

[PhanaticD]

using paper 1337 at the moment on my creative server ran into this weird issues where some kid with hacks did something with his plot with armor stands

the issue isnt minipets it happens without it

[01:05:39 WARN]: java.lang.reflect.InvocationTargetException
[01:05:39 WARN]:        at sun.reflect.GeneratedMethodAccessor55.invoke(Unknown Source)
[01:05:39 WARN]:        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
[01:05:39 WARN]:        at java.lang.reflect.Method.invoke(Method.java:498)
[01:05:39 WARN]:        at com.kirelcodes.miniaturepets.utils.ף.ח(NMSClassInteracter.java:143)
[01:05:39 WARN]:        at com.kirelcodes.miniaturepets..??ע???????????????????????????????????????????י?????????????????????ט??????????ו??ץ??א??????????????.סמ.<init>(EntityEquipmentOutPacket.java:15)
[01:05:39 WARN]:        at com.kirelcodes.miniaturepets..??ע???????????????????????????????????????????י?????????????????????ט??????????ו??ץ??א??????????????.ץג.ח(PacketStripper.java:18)
[01:05:39 WARN]:        at com.kirelcodes.miniaturepets..??ע???????????????????????????????????????????י?????????????????????ט??????????ו??ץ??א??????????????.זח.ד(EntityEquiepmentOutHandler.java:21)
[01:05:39 WARN]:        at com.kirelcodes.miniaturepets..??ע???????????????????????????????????????????י?????????????????????ט??????????ו??ץ??א??????????????.רו$2.onPacketSending(ProtcolLibHandler.java:50)
[01:05:39 WARN]:        at com.comphenix.protocol.injector.SortedPacketListenerList.invokeSendingListener(SortedPacketListenerList.java:195)
[01:05:39 WARN]:        at com.comphenix.protocol.injector.SortedPacketListenerList.invokePacketSending(SortedPacketListenerList.java:149)
[01:05:39 WARN]:        at com.comphenix.protocol.injector.PacketFilterManager.handlePacket(PacketFilterManager.java:588)
[01:05:39 WARN]:        at com.comphenix.protocol.injector.PacketFilterManager.invokePacketSending(PacketFilterManager.java:564)
[01:05:39 WARN]:        at com.comphenix.protocol.injector.netty.ProtocolInjector.packetQueued(ProtocolInjector.java:338)
[01:05:39 WARN]:        at com.comphenix.protocol.injector.netty.ProtocolInjector.onPacketSending(ProtocolInjector.java:298)
[01:05:39 WARN]:        at com.comphenix.protocol.injector.netty.ChannelInjector.processSending(ChannelInjector.java:398)
[01:05:39 WARN]:        at com.comphenix.protocol.injector.netty.ChannelInjector.access$500(ChannelInjector.java:78)
[01:05:39 WARN]:        at com.comphenix.protocol.injector.netty.ChannelInjector$5.handleScheduled(ChannelInjector.java:364)
[01:05:39 WARN]:        at com.comphenix.protocol.injector.netty.ChannelInjector$5.onMessageScheduled(ChannelInjector.java:332)
[01:05:39 WARN]:        at com.comphenix.protocol.injector.netty.ChannelProxy$2.schedulingRunnable(ChannelProxy.java:127)
[01:05:39 WARN]:        at com.comphenix.protocol.injector.netty.EventLoopProxy.execute(EventLoopProxy.java:95)
[01:05:39 WARN]:        at net.minecraft.server.v1_12_R1.NetworkManager.a(NetworkManager.java:199)
[01:05:39 WARN]:        at net.minecraft.server.v1_12_R1.NetworkManager.sendPacket(NetworkManager.java:147)
[01:05:39 WARN]:        at net.minecraft.server.v1_12_R1.PlayerConnection.sendPacket(PlayerConnection.java:1183)
[01:05:39 WARN]:        at net.minecraft.server.v1_12_R1.EntityTrackerEntry.updatePlayer(EntityTrackerEntry.java:411)
[01:05:39 WARN]:        at net.minecraft.server.v1_12_R1.EntityTracker.a(EntityTracker.java:264)
[01:05:39 WARN]:        at net.minecraft.server.v1_12_R1.PlayerChunk.b(PlayerChunk.java:152)
[01:05:39 WARN]:        at net.minecraft.server.v1_12_R1.PlayerChunkMap.flush(PlayerChunkMap.java:214)
[01:05:39 WARN]:        at net.minecraft.server.v1_12_R1.WorldServer.doTick(WorldServer.java:325)
[01:05:39 WARN]:        at net.minecraft.server.v1_12_R1.MinecraftServer.D(MinecraftServer.java:898)
[01:05:39 WARN]:        at net.minecraft.server.v1_12_R1.DedicatedServer.D(DedicatedServer.java:426)
[01:05:39 WARN]:        at net.minecraft.server.v1_12_R1.MinecraftServer.C(MinecraftServer.java:767)
[01:05:39 WARN]:        at net.minecraft.server.v1_12_R1.MinecraftServer.run(MinecraftServer.java:665)
[01:05:39 WARN]:        at java.lang.Thread.run(Thread.java:745)
[01:05:39 WARN]: Caused by: java.lang.IllegalArgumentException: Extrenuous data in: 2147483647
[01:05:39 WARN]:        at org.apache.commons.lang.Validate.isTrue(Validate.java:93)
[01:05:39 WARN]:        at org.bukkit.Color.fromRGB(Color.java:145)
[01:05:39 WARN]:        at org.bukkit.craftbukkit.v1_12_R1.inventory.CraftMetaLeatherArmor.<init>(CraftMetaLeatherArmor.java:39)
[01:05:39 WARN]:        at org.bukkit.craftbukkit.v1_12_R1.inventory.CraftItemStack.getItemMeta(CraftItemStack.java:290)
[01:05:39 WARN]:        at org.bukkit.craftbukkit.v1_12_R1.inventory.CraftItemStack.asBukkitCopy(CraftItemStack.java:69)
[01:05:39 WARN]:        ... 33 more
[01:05:39 ERROR]: java.lang.IllegalArgumentException: Extrenuous data in: 2147483647

this is what you see for a split second before being kicked: https://gyazo.com/ec661bf2b3036d022dbf0e86e158da4b

[Leymooo]

Also wrong CustomPotionColor in CustomPotionEffect can cause this error

[Brokkonaut]

Someone tried that on my server too:

[22:44:28] [Server thread/INFO]: IchBinEinHans attempted to spawn in {"id" : "minecraft:armor_stand", "Count" : 1b, "tag" : {"EntityTag" : {"ArmorItems" : [{}, {}, {}, {"id" : "leather_helmet", "Count" : 1, "tag" : {"display" : {"color" : 2147483647, "Name" : "KickStand"}}}], "HandItems" : [{}, {}]}}, "Damage" : 0s}

[aikar]

This sounds like something those creative control plugins should handle.

Theres so many ways to exploit creative, not sure we should be trying to solve them all.

[Brokkonaut]

This is the plugin we use on our server to block things like that: https://www.spigotmc.org/resources/creativeitemcontrol.52605/ (Not created by me, I just updated it to 1.12) - For maximum security nothing should be on the whitelist.

[electronicboy]

As with Aikar, this is probably better off being dealt with by a plugin, Creative Mode is by design a "lets trust the client" mechanism, be that the "good" and the bad aspects of that, while it would be amazing for some safety in the server, the amount of work to validate every potential issue, is just somewhat unwieldy, and will virtually always be a cat and mouse kinda tale; There are already several plugins aimed at solving these issues which are already configurable and maintained, and much better than us also trying to chase the same mouse