Mojira Archive
MC-197603

clickEvents are not removed from items before they are shown in chat, allowing tricking players

The bug

It appears MC-124024 was never fixed for item names, or there has been a regression.

clickEvents are not removed when item names are displayed in chat. This allows tricking players, and is especially problematic since it can be abused by non-op Creative players (see MC-80483).

To fix this, a method similar to (or the same as) net.minecraft.world.entity.Entity.removeAction(Component) should be used.

Reproduction steps

  1. Summon a husk holding an item with a custom name.
    Use the following command in a command block:
    /summon husk ~ ~1 ~ {HandItems:[{id:diamond_sword,Count:1b,tag:{display:{Name:"{\"text\":\"Sword\",\"extra\":[{\"text\":\"]\\n<Player1> <-- Click my name :-\",\"italic\":false,\"hoverEvent\":{\"action\":\"show_text\",\"contents\":\"\"},\"clickEvent\":{\"action\":\"run_command\",\"value\":\"/say /op @p\"}}]}"}}}]}
    
  2. Switch to Survival mode and let the husk kill you
    → It looks like "Player1" wrote something in chat
  3. Click on "Player1" to reply to them
    You just executed an arbitrary command

Unresolved

Marcono1234

2020-08-10, 02:13 PM

2023-08-22, 02:26 PM

1

2

Confirmed

Normal

Platform

UI

1.16.2 Release Candidate 1, 1.16.2

-