Spawn eggs can set monster spawners to arbitrary entities, even those that aren't valid for spawn eggs

The bug

Spawn eggs can be used to set the entity that a monster spawner spawns, even if the entity for the spawn egg is not valid for spawn eggs. This changing can be done even by non-op players.

So, a player who has a monster spawner and a spawn egg that spawns TNT can set the spawner to spawn TNT entities, even though the spawn egg by itself doesn't work.

Reproduction

1. Give yourself a mob spawner:

   /give @p minecraft:mob_spawner

2. Give yourself a spawn egg that spawns TNT:

   /give @p minecraft:spawn_egg 1 0 {EntityTag:{id:"minecraft:tnt"}}

3. Deop yourself.
4. Observe that attempting to use the spawn egg spawns nothing.
5. Place the spawner, and then use the spawn egg on it.
6. Observe that the spawner's entity changes to TNT (and probably blows itself up)

Cause

While spawn eggs verify that the entity they are spawning is valid when you're right-clicking with them (ItemMonsterPlacer.spawnCreature / agn.a, line 170), they do not perform this validation when changing the mob on a spawner.

Recommended fix

Move the validation from spawning the entity to the place where the entity id is converted into a ResourceLocation.

This could be done by changing the bottom of ItemMonsterPlacer.func_190908_h to this (inserting code on line 226 of agn.h):

String s = nbttagcompound1.getString("id");
ResourceLocation resourcelocation = new ResourceLocation(s);
if (resourcelocation == null || !EntityList.ENTITY_EGGS.containsKey(entityID) || !StringUtils.equals(s, resourcelocation.toString())) {
    return null;
} else {
    return resourcelocation;
}

Basically, this makes it so that it is not possible to generate a spawn egg for entities that don't normally have spawn eggs. You'll also note that doing this causes the TNT spawn egg to no longer be named Spawn Block of TNT.

Non-recommended fixes

I don't recommend either of these possible fixes because it would make it much harder to create a good fix for MC-50605. However, both options (when combined) do also resolve this issue. The first option does not work on its own because monster spawners generate by themselves.

• Disallow non-op players from placing monster spawners
• Disallow non-op players from changing the entity in monster spawners using spawn eggs

Notes

• /give will be used to generate arbitrary items. However, the creative inventory can also be used to do this with a modified client, even when non-opped; as such, these items are freely obtainable.
• A mob spawner from the inventory will ignore its BlockEntityTag if the player is not opped, but will still place. This prohibits, for example, the following item from working:

  /give @p minecraft:mob_spawner 1 0 {BlockEntityTag:{SpawnData:{id:minecraft:tnt}}}

• Spawn eggs can be specified for arbitrary entities, but will refuse to spawn if the entity does not normally have a spawn egg.
• While monster spawners cannot be pick-blocked (MC-50605), they can still be put into the inventory from the above method and placed.

Limitations

This can only be used to set the id of the spawned entity. It cannot set tags, and thank goodness for that (because if it could, then it would be possible to spawn minecart command blocks with arbitrary commands).

This can only be used when creative mode is available. It does not work in survival.