Skip to content

Commit d74420b

Browse files
authored
Merge pull request cabaletta#4720 from ZacSharp/pr/1.19.4/commands/preventRemoteCommandExecution
Don't let servers trick users into running arbitrary Baritone commands
2 parents 2fc8490 + 7aab08a commit d74420b

File tree

1 file changed

+10
-4
lines changed

1 file changed

+10
-4
lines changed

src/launch/java/baritone/launch/mixins/MixinScreen.java

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,17 +21,19 @@
2121
import baritone.api.IBaritone;
2222
import baritone.api.event.events.ChatEvent;
2323
import baritone.utils.accessor.IGuiScreen;
24+
import net.minecraft.client.gui.screens.Screen;
2425
import net.minecraft.network.chat.ClickEvent;
2526
import net.minecraft.network.chat.Style;
2627
import org.spongepowered.asm.mixin.Mixin;
2728
import org.spongepowered.asm.mixin.gen.Invoker;
28-
29-
import java.net.URI;
30-
import net.minecraft.client.gui.screens.Screen;
3129
import org.spongepowered.asm.mixin.injection.At;
3230
import org.spongepowered.asm.mixin.injection.Inject;
3331
import org.spongepowered.asm.mixin.injection.callback.CallbackInfoReturnable;
3432

33+
import java.net.URI;
34+
35+
import static baritone.api.command.IBaritoneChatControl.FORCE_COMMAND_PREFIX;
36+
3537
@Mixin(Screen.class)
3638
public abstract class MixinScreen implements IGuiScreen {
3739

@@ -47,9 +49,13 @@ public void handleCustomClickEvent(Style style, CallbackInfoReturnable<Boolean>
4749
if (clickEvent == null) {
4850
return;
4951
}
52+
String command = clickEvent.getValue();
53+
if (command == null || !command.startsWith(FORCE_COMMAND_PREFIX)) {
54+
return;
55+
}
5056
IBaritone baritone = BaritoneAPI.getProvider().getPrimaryBaritone();
5157
if (baritone != null) {
52-
baritone.getGameEventHandler().onSendChatMessage(new ChatEvent(clickEvent.getValue()));
58+
baritone.getGameEventHandler().onSendChatMessage(new ChatEvent(command));
5359
}
5460
cir.setReturnValue(true);
5561
cir.cancel();

0 commit comments

Comments
 (0)