MC-272627Leash holder UUID is unchecked during NBT deserialization
When running the following command (or a similar command with a UUID that is not a valid integer array), an exception will be thrown and an "Unable to summon entity" error will be sent:
/summon minecraft:cow ~ ~ ~ {leash: {UUID: 1}}
This is equivalent to the following spawn egg, which fails to spawn a cow and prints an exception to the log:
/give @s minecraft:cow_spawn_egg[minecraft:entity_data={id: cow, leash: {UUID: 1}}]
Code analysis (Yarn mappings)
The NbtCompound#containsUuid method validates that a given key has a valid UUID value before the NbtCompound#getUuid method, which throws an exception for invalid UUIDs, is called. In all other cases of NBT deserialization, these methods work in tandem.
However, the Leashable#readLeashDataFromNbt only calls the NbtCompound#getUuid method. Therefore, it will throw an exception for invalid UUIDs.
Attachments1
Created Issue:
Leash holder UUID is unchecked during NBT deserialization
When running the following command (or a similar command with a UUID that is not a valid integer array), an exception will be thrown and an "Unable to summon entity" error will be sent:
/summon minecraft:cow ~ ~ ~ {leash: {UUID: 1}}Code analysis (Yarn mappings)
The NbtCompound#containsUuid method validates that a given key has a valid UUID value before the NbtCompound#getUuid method, which throws an exception for invalid UUIDs, is called. In all other cases of NBT deserialization, these methods work in tandem.
However, the Leashable#readLeashDataFromNbt only calls the NbtCompound#getUuid method. Therefore, it will throw an exception for invalid UUIDs.
![[Mod] Michael Wobst](../../../data/avatars/users/37868.png){kind=small}
![[Mojang] Timur Nazarov](../../../data/avatars/users/18945.svg){kind=small}
![[Mojang] Triage Team](../../../data/avatars/users/89842.png){kind=small}
![[MCQA] v-magwar](../../../data/avatars/users/18935.svg){kind=small}
![[Mod] Jarl-Penguin](../../../data/avatars/users/92849.png){kind=small}
When running the following command (or a similar command with a UUID that is not a valid integer array), an exception will be thrown and an "Unable to summon entity" error will be sent:
/summon minecraft:cow ~ ~ ~ {leash: {UUID: 1}}This is equivalent to the following spawn egg, which fails to spawn a cow and prints an exception to the log:
/give @s minecraft:cow_spawn_egg[minecraft:entity_data={id: cow, leash: {UUID: 1}}]Code analysis (Yarn mappings)
The NbtCompound#containsUuid method validates that a given key has a valid UUID value before the NbtCompound#getUuid method, which throws an exception for invalid UUIDs, is called. In all other cases of NBT deserialization, these methods work in tandem.
However, the Leashable#readLeashDataFromNbt only calls the NbtCompound#getUuid method. Therefore, it will throw an exception for invalid UUIDs.
![[Mojang] Gnembon](../../../data/avatars/users/93709.png){kind=small}
Low![[Mojang] Maxime Lebrot](../../../data/avatars/users/18941.svg){kind=small}
I'm confused at the 'won't fix' resolution considering the ability for users to exploit this issue and slow down the server compared to the apparent simplicity of the issue. It's easy for a creative mode player to obtain a spawn egg and place it into a hopper feeding into a dispenser that activates every tick to slow down the server (from my machine-dependent testing limiting the TPS of a sprint to 20 TPS), or place many copies of that same setup to slow it down further.
In addition, NBT loading and command execution by extension has typically been pretty exception-proof; in my opinion it's odd that this would become the, err, exception.