Mojira Archive
MC-197908

Usage of spawn egg does not check OP-level when applying EntityTag

The bug

When a player uses a spawn egg with EntityTag (obtained for example using Creative mode, see also MC-80483) it only checks whether the player is an operator, but does not check their OP-level.
This is problematic because a OP-level 0 player can use a spawn egg for a command_block_minecart which then executes commands requiring OP-level 2.

Reproduction steps

  1. Start a dedicated server and join it. Make sure enable-command-block is set to true
  2. /op yourself
  3. Obtain the following spawn egg
    /give @p pig_spawn_egg{EntityTag:{id:command_block_minecart,Command:"say This would have required OP level 1"}}
    
  4. Stop the server, and edit the ops.json file and change the level value to 0
  5. Start the server again
  6. Place an activator rail, power it and use the spawn egg from step 3 on it
    It executed a command which requires a higher OP-level than you have

Code analysis

1.16.2, Mojang names

net.minecraft.world.entity.EntityType.updateCustomEntityTag(Level, Player, Entity, CompoundTag) only checks whether the player is an operator instead of checking net.minecraft.world.entity.player.Player.canUseGameMasterBlocks().

Unresolved

Marcono1234

2020-08-13, 03:16 PM

2024-10-14, 08:47 PM

1

1

Confirmed

Low

Platform

Commands

1.16.2, 1.21.1, 1.21.2 Pre-Release 3

-