Allow safe outbound item metadata for TheHerobrine-OG #7

2026-07-22T18:03:39-04:00

NotAlexNoyle commented

2026-07-22 18:03:39 -04:00

(Migrated from github.com)

What changed

Treat valid server-generated Unbreakable byte values (0 or 1) as safe on outbound item packets.
Treat valid server-generated HideFlags integer masks (0x00 through 0x7F) as safe on outbound item packets.
Preserve the existing checks for player-to-server creative inventory packets and all other NBT tags.

Why

TheHerobrine-OG creates legitimate kit and GUI items using Bukkit item metadata, including unbreakable equipment and hidden item flags. Panilla-OG previously rejected these tags unconditionally, causing PacketPlayOutSetSlot and PacketPlayOutWindowItems packets to be dropped and the metadata to be stripped from player inventories.

Security impact

This is deliberately narrower than adding the tags to the global NBT whitelist. The exemption applies only to outbound, server-generated item packets and verifies both the NBT type and allowed vanilla value range. Client-supplied creative NBT remains subject to the existing Panilla checks.

Validation

Confirmed the branch is one commit ahead of master with only NbtChecks.java changed.
Reviewed the 1.19.4 packet path used by PacketPlayOutSetSlot and PacketPlayOutWindowItems.
A full Gradle build could not be run in this environment because the GitHub CLI and repository checkout are unavailable; the change is confined to the API module and uses existing INbtTagCompound/NbtDataType methods.

## What changed - Treat valid server-generated `Unbreakable` byte values (`0` or `1`) as safe on outbound item packets. - Treat valid server-generated `HideFlags` integer masks (`0x00` through `0x7F`) as safe on outbound item packets. - Preserve the existing checks for player-to-server creative inventory packets and all other NBT tags. ## Why TheHerobrine-OG creates legitimate kit and GUI items using Bukkit item metadata, including unbreakable equipment and hidden item flags. Panilla-OG previously rejected these tags unconditionally, causing `PacketPlayOutSetSlot` and `PacketPlayOutWindowItems` packets to be dropped and the metadata to be stripped from player inventories. ## Security impact This is deliberately narrower than adding the tags to the global NBT whitelist. The exemption applies only to outbound, server-generated item packets and verifies both the NBT type and allowed vanilla value range. Client-supplied creative NBT remains subject to the existing Panilla checks. ## Validation - Confirmed the branch is one commit ahead of `master` with only `NbtChecks.java` changed. - Reviewed the 1.19.4 packet path used by `PacketPlayOutSetSlot` and `PacketPlayOutWindowItems`. - A full Gradle build could not be run in this environment because the GitHub CLI and repository checkout are unavailable; the change is confined to the API module and uses existing `INbtTagCompound`/`NbtDataType` methods.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: trueog/Panilla-OG#7