Major design flaw in extra component serialization can be abused to crash servers and clients extremely easily
Explanation
The "extra" component was introduced in 1.7 to help make text components more customizable and flexible. However, there is a design flaw in how they are serialized which allows you to nest an infinite amount of components in it, and once you nest enough components in one, pretty much anything that tries to process it will throw a StackOverflowError and instantly crash whatever was trying to use it. This design flaw has been in the component system in versions 1.7.2 all the way to the latest version, 1.20.1.
Furthermore, this issue is especially dangerous for servers for two reasons:
- It's stupidly easy to abuse
If you apply a component that abuses this design flaw to a Shulker Box's custom name, simply placing it down will instantly crash the server. Since it can be imported from Saved Hotbars, deploying it is incredibly quick and easy. To prove this and to give you an idea of how bad it actually is, I've included a recording of myself doing it in a singleplayer world. - It can be used to spam server logs and inflate crash reports
This is primarily due to the fact that the size of the stacktrace can be incredibly large if you keep nesting the components enough times.
Steps to reproduce
Method 1:
- Download the attached hotbar.nbt file and copy it into your .minecraft folder (make sure to back up the original file if it doesn't already exist!)
- Launch the game and load a world you don't care about
- Put the dispenser from the first row in the Saved Hotbars tab into your inventory
- Place the dispenser
- Power the dispenser
Method 2:
- Download the attached hotbar.nbt file and copy it into your .minecraft folder (make sure to back up the original file if it doesn't already exist!)
- Launch the game and load a world you don't care about
- Put the shulker box from the second row in the Saved Hotbars tab into your inventory
- Place the shulker box