The Bug:

Players without operator permissions cannot normally interact with blocks inside spawn protection, however, you are able to ignite candles using flaming projectiles, regardless of whether or not they're inside of spawn protection.

Steps to Reproduce:

1. Start a server, join it, give operator permissions to yourself, and switch into creative mode.
2. Set the world spawn to your current location and obtain a bow enchanted with flame by using the commands provided below.

   /setworldspawn ~ ~ ~

   /give @s minecraft:bow{Enchantments:[{id:"minecraft:flame",lvl:1}]}

3. Place down some candles nearby and obtain some arrows.
4. Switch into survival mode, remove your operator permissions, and grant anyone else with them in order to activate spawn protection.
5. Attempt to ignite the candles by shooting flaming arrows on them.
6. Take note as to whether or not you can ignite candles by using flaming projectiles in spawn protection.

Observed Behavior:

Candles are ignited.

Expected Behavior:

Candles would not be ignited.

Code Analysis:

Code analysis by Avoma can be found below.

The following is based on a decompiled version of Minecraft 1.18.1 using MCP-Reborn.

public abstract class AbstractCandleBlock extends Block {
   ...
   public void onProjectileHit(Level $l, BlockState $bs, BlockHitResult $bhr, Projectile $p) {
      if (!$l.isClientSide && $p.isOnFire() && this.canBeLit($bs)) {
         setLit($l, $bs, $bhr.getBlockPos(), true);
      }

   }
   ...

If we look at the above class, we can see that only three checks are carried out before the game allows a candle block to be ignited through the use of a flaming projectile. These three checks are as follows:

• The action must occur non-client-side.
• The projectile shot at the candle block must be on fire.
• The candle must not be lit.

If these three requirements are met, the candle block will be ignited, and since the game doesn't check whether or not the candle block is within spawn protection, this results in the problem of being able to ignite candles by using flaming projectiles in spawn protection.

Potential Fix:

Simply adding some lines of code that check if the candle block is within spawn protection before igniting it, should resolve this problem. This can be achieved by calling the mayInteract() method and adding it appropriately somewhere within the existing "if" statement. The fixed piece of code within its class should look something like the following:

public abstract class AbstractCandleBlock extends Block {
   ...
   public void onProjectileHit(Level $l, BlockState $bs, BlockHitResult $bhr, Projectile $p) {
      BlockPos blockpos = $bhr.getBlockPos();
      if (!$l.isClientSide && $p.mayInteract($l, blockpos) && $p.isOnFire() && this.canBeLit($bs)) {
         setLit($l, $bs, blockpos, true);
      }

   }
   ...