Usage of spawn egg does not check OP-level when applying EntityTag
The bug
When a player uses a spawn egg with EntityTag (obtained for example using Creative mode, see also MC-80483) it only checks whether the player is an operator, but does not check their OP-level.
This is problematic because a OP-level 0 player can use a spawn egg for a command_block_minecart which then executes commands requiring OP-level 2.
Reproduction steps
- Start a dedicated server and join it. Make sure enable-command-block is set to true
- /op yourself
- Obtain the following spawn egg
/give @p pig_spawn_egg{EntityTag:{id:command_block_minecart,Command:"say This would have required OP level 1"}} - Stop the server, and edit the ops.json file and change the level value to 0
- Start the server again
- Place an activator rail, power it and use the spawn egg from step 3 on it
It executed a command which requires a higher OP-level than you have
Code analysis
1.16.2, Mojang names
net.minecraft.world.entity.EntityType.updateCustomEntityTag(Level, Player, Entity, CompoundTag) only checks whether the player is an operator instead of checking net.minecraft.world.entity.player.Player.canUseGameMasterBlocks().