The Bug:

Players without operator permissions cannot normally destroy blocks inside spawn protection, however, if a player were to ride a boat into some lily pads, they would be destroyed, regardless of whether or not they're inside of spawn protection.

Steps to Reproduce:

1. Start a server, join it, give operator permissions to yourself, and switch into creative mode.
2. Set the world spawn to your current location and summon a large area of water below your feet by using the commands provided below.

   /setworldspawn ~ ~ ~

   /fill ~10 ~-1 ~10 ~-10 ~-1 ~-10 minecraft:water

3. Summon a boat and place down some lily pads nearby.
4. Switch into survival mode, remove your operator permissions, and grant anyone else with them in order to activate spawn protection.
5. Get inside of the boat and attempt to destroy the lily pads you previously placed by riding into them.
6. Take note as to whether or not you can destroy lily pads by using boats in spawn protection.

Observed Behavior:

Lily pads are destroyed.

Expected Behavior:

Lily pads would not be destroyed.

Code Analysis:

Code analysis by Avoma can be found below.

The following is based on a decompiled version of Minecraft 1.18.1 using MCP-Reborn.

public class WaterlilyBlock extends BushBlock {
   ...
   public void entityInside(BlockState $bs, Level $l, BlockPos $bp, Entity $e) {
      super.entityInside($bs, $l, $bp, $e);
      if ($l instanceof ServerLevel && $e instanceof Boat) {
         $l.destroyBlock(new BlockPos($bp), true, $e);
      }

   }
   ...

If we look at the above class, we can see that no checks are carried out to see whether or the lily pad block is within spawn protection before it can be destroyed when coming into close contact with a boat. The mayInteract() method (a method used for determining whether a block is inside of spawn protection and is within the world border) is never called within this piece of code, thus resulting in the problem of being able to destroy lily pads by using boats in spawn protection.