Mojira Archive
MCPE-39895

Commands containing new lines are executed instantly when pasted into chat

The issue

When a command is pasted into chat, the command is instantly executed if it contains a newline, with no chance for the user to look at or edit it. This applies to regular chat messages, but is particularly harmful for commands.

A malicious application could send a command such as /kill @e or something equally harmful to the clipboard and instruct the player to paste it into chat. Normally that would not be a problem because the user would instantly recognize the command is not what they expect. However, if the command ends with (or otherwise contains) a newline, the command is evaluated immediately. The user would not be aware anything had gone wrong until it was too late.

 How to reproduce

Copy the following to your clipboard, then paste it in-game in chat:

/say This could have been
 a more dangerous command!

Works As Intended

[Mod] tryashtar

2018-12-18, 12:32 AM

2019-01-09, 04:30 PM

2019-01-09, 04:30 PM

0

1

Confirmed

165827

1.8.0

-