Skip to content

Fix BookHack#378

Open
MasterDash5 wants to merge 3 commits intohpfxd:masterfrom
dashnetworkxyz:bookhack-fix
Open

Fix BookHack#378
MasterDash5 wants to merge 3 commits intohpfxd:masterfrom
dashnetworkxyz:bookhack-fix

Conversation

@MasterDash5
Copy link

This resolves an issue where players can sign a book with JSON formatted components in the pages. Some modded clients abuse this to create books that contain a clickEvent to trick an admin to run a command.

This PR strips the pages of components when books are signed.

@hpfxd
Copy link
Owner

hpfxd commented Jan 13, 2026

I think this should be behind a config option.

Also, it's possible to color books in Vanilla 1.8 by pasting the special § character. I'm unsure if that's converted into components before being sent to the server, but if that's the case, I think this should be disabled by default to not interfere with that mechanic.

@MasterDash5
Copy link
Author

This doesn't affect pasting the § character in the book. This is just for JSON components, which can only be sent by a modded client. It's also worth noting 1.12 and newer have this same fix, so I don't see much benefit in turning this behavior off.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants