Uploaded image for project: 'Minecraft: Java Edition'
  1. Minecraft: Java Edition
  2. MC-130664

Exploitable target selector in /tell command

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Resolved
    • Resolution: Duplicate
    • Affects Version/s: Minecraft 1.12.2, Minecraft 18w22c
    • Fix Version/s: None
    • Labels:
    • Confirmation Status:
      Unconfirmed

      Description

      Because /tell (and /msg and /w) uses a target selector you can exploit it to find out information about players. This is not so relevant in 1.12 because you don't have the nbt target selector, just the distance or coordinates, but in 1.13 you can find out anything about a player(every nbt data) with this.

      Example:

      I am playing a pvp survival game against some other players and want to know if there is someone near me. I just tell everybody in my radius a random text and see who I messaged:

       

      /msg @a[distance=..100] Wanna team?

      or, in 1.12:

      /msg @a[r=100] Wanna team

      Now I will get some text in my chat for every player who is in radius of 100 meters.

      Messaging_Player whispers to Found_Player: Wanna team

      To find out if I should fight him, I check if he has a diamond sword:

      This only works in 1.13, because the nbt selector will be added then!

      /msg @a[name=Found_Player,nbt={Inventory:[{id:"minecraft:diamond_sword"}]}] Pls team!

      This will again give me a message if he has a diamond sword.

      Messaging_Player whispers to Found_Player: Pls team!

      More examples of commands:

      Check who is wearing iron helmet:

      /msg @a[nbt={Inventory:[{id:"minecraft:iron_helmet",Slot:103b}]}] Pls team!

      Check out his enderchest items and find out if he has golden apples:

      /msg @a[name=Found_Player,nbt={EnderItems:[{id:"minecraft:golden_apple"}]}] Pls team!

      Find out if he is deep underground and probably mining:

      /msg @a[name=Found_Player,y=0,dy=13] Pls team!

      Find nearest player:

      /msg @a[sort=nearest,distance=1..] Pls team

      Find all players who are in the nether:

      /msg @a[nbt={Dimension:-1}] Pls team!

      The possibility are endless. I would highly advise to make a command that is limited to player names only, so survival players can't exploit target selectors.

       

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                Unassigned
                Reporter:
                Jummit Jummit
              • Votes:
                0 Vote for this issue
                Watchers:
                1 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: