Normal players can use player selectors
With enough players online, entering a command like the following kicks all players because @a gets expanded to a list of all online players.
/me @a @a @a @a @a @a @a @a @a @a @a @a ...
This is what it looks like from the logfile.
derp lost connection: TranslatableComponent{key='disconnect.genericReason', args=[Internal Exception: io.netty.handler.codec.EncoderException: java.io.IOException: String too big (was 33145 bytes encoded, max 32767)
At this point my server has become unplayable with more than 10 people online. This issue is well-known and spreading. I expect waves of players doing this to every vanilla server.
Environment
Ubuntu 12.04 64bit
Java HotSpot(TM) 64-Bit Server VM (build 23.7-b01, mixed mode)
Linked Issues
is duplicated by10
MC-40319@a, @p and similar modifiers can be used in /tell commandDuplicateMC-44000 io.netty.handler.codec.EncoderException: java.io.IOException: String too big (was 61545 bytes encoded, max 32767)DuplicateMC-44007Spammers can crash any Vanilla server with a few keystroke from chat windowDuplicateMC-44102Normal players can use @a, @p, @r selectorsDuplicateMC-44157Command-Modifiers and conditions like @p or r= can be abusedDuplicateMC-45100Saying @e on a server sometimes disconects all players.DuplicateMC-50397Server Disconnect on typing "/say The nearest entity is @e"DuplicateMC-51649Normal, non-op players can still use player selectors in /tell.DuplicateMC-59399Abel to detect Players position with @e selectorDuplicateMC-60974Super size chat messages disconnect clientsDuplicate
Created Issue:
Repeating @a in /me kicks all players because it gets expanded
With enough players online, entering a command like the following kicks all players because @a gets expanded to a list of all online players.
/me @a @a @a @a @a @a @a @a @a @a @a @a ...
This is what it looks like from the logfile.
derp lost connection: TranslatableComponent{key='disconnect.genericReason', args=[Internal Exception: io.netty.handler.codec.EncoderException: java.io.IOException: String too big (was 33145 bytes encoded, max 32767)
At this point my server has become unplayable with more than 10 people online. This issue is well-known and spreading. I expect waves of players doing this to every vanilla server.
Environment
Ubuntu 12.04 64bit
Java HotSpot(TM) 64-Bit Server VM (build 23.7-b01, mixed mode)
is duplicated by
is duplicated by
is duplicated by
relates to
relates to
![[Mojang] Nathan Adams](../../../data/assets/gravatar/dinnerbone.png){kind=small}
[Mojang] Nathan AdamsRepeating @a in /me kicks all players because it gets expandedNormal players can use player selectors
is duplicated by
is duplicated by
is duplicated by
is duplicated by
is duplicated by
relates to
![[Mod] Neko](../../../data/avatars/users/92901.png){kind=small}
relates to
![[Mod] tryashtar](../../../data/avatars/users/41963.png){kind=small}
![[Mod] Pokechu22](../../../data/avatars/users/92931.png){kind=small}
is cloned by
![[Mod] Torabi](../../../data/assets/gravatar/torabi.png){kind=small}
"Resolved" does not mean "Fixed". It means that a decision has been made. In this case, I believe it's been marked a duplicate of MC-43984, which unfortunately isn't showing on the ticket. I'm guessing that MC-43984 has been made private, as it relates to an exploit, and they don't want to publicize discussion on it. So take that as an indication that they are taking this seriously.
This bug is still happens in 1.8
Please update it and add to the title "Score and Selector tag..."
Most likely caused by the fix of MC-43984
Does MC-43984 describe ths issue ?
Otherwise, please provide the exact command you've used.
The bug
Selectors in the text of the command /me (in previous versions also /tell, /msg and /w) are not resolved when an operator uses the command. They are however resolved when the command sender is not a player like for example an entity, a command block or a sign.
How to reproduce
Use the following command as operator
/me Closest player: @p
Code analysis
Based on 1.11.2 decompiled using MCP 9.35 rc1
This feature was probably disabled as a fix for MC-43984, but for all players. This can be solved by having the methods net.minecraft.command.server.CommandEmote.execute(MinecraftServer, ICommandSender, String[]) and net.minecraft.command.server.CommandMessage.execute(MinecraftServer, ICommandSender, String[]) call a method which calls the method net.minecraft.command.CommandBase.getChatComponentFromNthArg(ICommandSender, String[], int, boolean) with the boolean parameter value being if the player can use selectors.
public static ITextComponent getChatComponentFromNthArgIfCanUseSelector(ICommandSender sender, String[] args, int index) throws PlayerNotFoundException, CommandException { return getChatComponentFromNthArg(sender, args, index, sender.canUseCommand(1, "")); }
Please fix this soon. Running an open vanilla server is impossible with this bug. Fixing it should be as simple as disabling selectors in /me.
I've heard that
MC-44000may be a duplicate of this but I don't have access and cannot confirm this myself.Setting that ticket to public since most of the duplicates are public too.
Tested in 14w11b. Can still use /tell @a without being op. Using various selectors, it is possible to locate other players, for example:
Using trigonometry, a player can obtain the exact cords of a player in 3 whispers.
Reopened because of /tell
Using the selector @e and arguments like [r=1000000] is is possible to crash Minecraft. (That is, if the radius is above 500,000)
Well they finally fixed the "nuke a map with the give command" bug last month, maybe they'll get around to this.
Is this still a concern in the current Minecraft version 14w21b / Launcher version 1.4.4 or later? If so, please update the affected versions in order to best aid Mojang ensuring bugs are still valid in the latest releases/pre-releases.
Issue persists in 14w21b. It's much worse now because non-op users can now cause the server to halt:
The higher r= is, the more likely the server will completely halt. Why are selectors even allowed by non-op players in the first place?
Still present in 14w27b. There is another way to track players by not sending a whisper and not including a message. It will output an error for every player that is in the area you are whispering. The commands used are: /w @a[x=0,z=0,r=10000] and /w @a[name=Player,x=0,z=0,r=10000]
On my Realms I did /say @e and it gave me the error:
internal Exception: io.netty.handler.codec.DecoderException: java.lang.IndexOutOfBoundsException: readerIndex(1) + length(1) exceeds writerIndex(1): UnpooledHeapByteBuf(ridx: 1, widx: 1, cap: 1)
Back in 17w45a
Re-resolving as fixed (in the version it was originally fixed in) in favor of creating a clone issue,
MC-121739.