Skip to content

Improve Safe MiniMessage Parser Control#8533

Merged
sovdeeth merged 4 commits intodev/featurefrom
feature/better-mm-parser-control
Apr 12, 2026
Merged

Improve Safe MiniMessage Parser Control#8533
sovdeeth merged 4 commits intodev/featurefrom
feature/better-mm-parser-control

Conversation

@APickledWalrus
Copy link
Copy Markdown
Member

@APickledWalrus APickledWalrus commented Apr 10, 2026

Problem

While we have defined a set of MiniMessage tags we believe are best to parse automatically, some users may want more control over what is automatically parsed.

Solution

I have added a configuration option for controlling which tags are parsed by default. These can be supplied as specific tag names or the internal group used in MiniMessage (specifically, the name of the tag resolver in the StandardTags class). I have also done some reorganizing of the component parser class.

Safe Tag Changes

The primary intention (even before MiniMessage integration) was to prevent security issues from normal users sending messages with click events (e.g. to run malicious commands). That is, a common use case is something like:

set the chat message to the colored message

Ideally, this should only process safe formatting and not potentially dangerous formatting like click events. I'm not sure this worked super well on current versions (e.g. 2.14.3), but going forward, we'll establish that only some Style-related tags (colors, decorations) will be processed by default. These are the default tags listed in the configuration file.

Testing Completed

I added a small unit test covering some parts of the component parser.

Supporting Information

n/a


Completes: none
Related: none
AI assistance: none

@APickledWalrus APickledWalrus requested a review from a team as a code owner April 10, 2026 14:31
@APickledWalrus APickledWalrus added the 2.15 Targeting a 2.15.X version release. label Apr 10, 2026
@APickledWalrus APickledWalrus requested review from cheeezburga and erenkarakal and removed request for a team April 10, 2026 14:31
@APickledWalrus APickledWalrus moved this to In Review in 2.15 Releases Apr 10, 2026
public LinkParseMode linkParseMode() {
return linkParseMode;
}
private TagResolver createSkriptTagResolver(boolean isSafeMode) {
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could benefit from having a create safe and unsafe methods :)

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's the internal one so I figured it'd be okay

@github-project-automation github-project-automation bot moved this from In Review to Awaiting Merge in 2.15 Releases Apr 12, 2026
@skriptlang-automation skriptlang-automation bot added the feature-ready A PR/issue that has been approved, tested and can be merged/closed in the next feature version. label Apr 12, 2026
@sovdeeth sovdeeth merged commit 0d0999c into dev/feature Apr 12, 2026
14 checks passed
@github-project-automation github-project-automation bot moved this from Awaiting Merge to Done - Awaiting Release in 2.15 Releases Apr 12, 2026
@skriptlang-automation skriptlang-automation bot added completed The issue has been fully resolved and the change will be in the next Skript update. and removed feature-ready A PR/issue that has been approved, tested and can be merged/closed in the next feature version. labels Apr 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

2.15 Targeting a 2.15.X version release. completed The issue has been fully resolved and the change will be in the next Skript update.

Projects

Status: Done - Awaiting Release

Development

Successfully merging this pull request may close these issues.

3 participants