Paper/Spigot-Server-Patches/0170-Filter-bad-data-from-ArmorStand-and-SpawnEgg-items.patch

From 022c321aa2f4f286f4d927656105aea40f59aed5 Mon Sep 17 00:00:00 2001
From: Zach Brown <zach.brown@destroystokyo.com>
Date: Sat, 12 Nov 2016 23:25:22 -0600
Subject: [PATCH] Filter bad data from ArmorStand and SpawnEgg items


diff --git a/src/main/java/com/destroystokyo/paper/PaperWorldConfig.java b/src/main/java/com/destroystokyo/paper/PaperWorldConfig.java
index 4ca44afa9..dcf64efcc 100644
--- a/src/main/java/com/destroystokyo/paper/PaperWorldConfig.java
+++ b/src/main/java/com/destroystokyo/paper/PaperWorldConfig.java
@@ -385,4 +385,12 @@ public class PaperWorldConfig {
     private void removeCorruptTEs() {
         removeCorruptTEs = getBoolean("remove-corrupt-tile-entities", false);
     }
+
+    public boolean filterNBTFromSpawnEgg = true;
+    private void fitlerNBTFromSpawnEgg() {
+        filterNBTFromSpawnEgg = getBoolean("filter-nbt-data-from-spawn-eggs-and-related", true);
+        if (!filterNBTFromSpawnEgg) {
+            Bukkit.getLogger().warning("Spawn Egg and Armor Stand NBT filtering disabled, this is a potential security risk");
+        }
+    }
 }
diff --git a/src/main/java/net/minecraft/server/EntityFallingBlock.java b/src/main/java/net/minecraft/server/EntityFallingBlock.java
index 8059e6dcd..a4f465e38 100644
--- a/src/main/java/net/minecraft/server/EntityFallingBlock.java
+++ b/src/main/java/net/minecraft/server/EntityFallingBlock.java
@@ -251,6 +251,14 @@ public class EntityFallingBlock extends Entity {
             this.block = Block.getById(nbttagcompound.getByte("Tile") & 255).fromLegacyData(i);
         }
 
+        // Paper start - Block FallingBlocks with Command Blocks
+        // Check mappings on update - dc = "repeating_command_block" - dd = "chain_command_block"
+        final Block b = this.block.getBlock();
+        if (this.world.paperConfig.filterNBTFromSpawnEgg && (b == Blocks.COMMAND_BLOCK || b == Blocks.dc || b == Blocks.dd)) {
+            this.block = Blocks.STONE.getBlockData();
+        }
+        // Paper end
+
         this.ticksLived = nbttagcompound.getInt("Time");
         Block block = this.block.getBlock();
 
diff --git a/src/main/java/net/minecraft/server/ItemMonsterEgg.java b/src/main/java/net/minecraft/server/ItemMonsterEgg.java
index 1a01a57d2..f914ad417 100644
--- a/src/main/java/net/minecraft/server/ItemMonsterEgg.java
+++ b/src/main/java/net/minecraft/server/ItemMonsterEgg.java
@@ -102,7 +102,14 @@ public class ItemMonsterEgg extends Item {
                 NBTTagCompound nbttagcompound1 = entity.e(new NBTTagCompound());
                 UUID uuid = entity.getUniqueID();
 
-                nbttagcompound1.a(nbttagcompound.getCompound("EntityTag"));
+                // Paper start - Filter out position and motion information
+                final NBTTagCompound entityTag = nbttagcompound.getCompound("EntityTag");
+                if (world.paperConfig.filterNBTFromSpawnEgg) {
+                    entityTag.remove("Pos");
+                    entityTag.remove("Motion");
+                }
+                nbttagcompound1.a(entityTag);
+                // Paper end
                 entity.a(uuid);
                 entity.f(nbttagcompound1);
             }
-- 
2.12.0.windows.1