clickEvents are not removed from items before they are shown in chat, allowing tricking players
The bug
It appears MC-124024 was never fixed for item names, or there has been a regression.
clickEvents are not removed when item names are displayed in chat. This allows tricking players, and is especially problematic since it can be abused by non-op Creative players (see MC-80483).
To fix this, a method similar to (or the same as) net.minecraft.world.entity.Entity.removeAction(Component) should be used.
Reproduction steps
- Summon a husk holding an item with a custom name.
Use the following command in a command block:/summon husk ~ ~1 ~ {HandItems:[{id:diamond_sword,Count:1b,tag:{display:{Name:"{\"text\":\"Sword\",\"extra\":[{\"text\":\"]\\n<Player1> <-- Click my name :-\",\"italic\":false,\"hoverEvent\":{\"action\":\"show_text\",\"contents\":\"\"},\"clickEvent\":{\"action\":\"run_command\",\"value\":\"/say /op @p\"}}]}"}}}]} - Switch to Survival mode and let the husk kill you
→ It looks like "Player1" wrote something in chat - Click on "Player1" to reply to them
You just executed an arbitrary command