Add validation to player profile and properties (#10680)

patches/api/Basic-PlayerProfile-API.patch

@@ -91,13 +91,16 @@ index 0000000000000000000000000000000000000000..00000000000000000000000000000000
 +
 +    /**
 +     * Sets a property. If the property already exists, the previous one will be replaced
++     *
 +     * @param property Property to set.
++     * @throws IllegalArgumentException if setting the property results in more than 16 properties
 +     */
 +    void setProperty(@NotNull ProfileProperty property);
 +
 +    /**
 +     * Sets multiple properties. If any of the set properties already exist, it will be replaced
 +     * @param properties The properties to set
++     * @throws IllegalArgumentException if the number of properties exceeds 16
 +     */
 +    void setProperties(@NotNull Collection<ProfileProperty> properties);
 +
@@ -272,6 +275,9 @@ index 0000000000000000000000000000000000000000..00000000000000000000000000000000
 +        this.name = Preconditions.checkNotNull(name, "ProfileProperty name can not be null");
 +        this.value = Preconditions.checkNotNull(value, "ProfileProperty value can not be null");
 +        this.signature = signature;
++        Preconditions.checkArgument(name.length() <= 64, "ProfileProperty name can not be longer than 64 characters");
++        Preconditions.checkArgument(value.length() <= Short.MAX_VALUE, "ProfileProperty value can not be longer than 32767 characters");
++        Preconditions.checkArgument(signature == null || signature.length() <= 1024, "ProfileProperty signature can not be longer than 1024 characters");
 +    }
 +
 +    /**
@@ -464,6 +470,7 @@ index 0000000000000000000000000000000000000000..00000000000000000000000000000000
 +     * @param uuid UUID to create profile for
 +     * @param name Name to create profile for
 +     * @return A PlayerProfile object
++     * @throws IllegalArgumentException if the name is longer than 16 characters
 +     */
 +    @NotNull
 +    com.destroystokyo.paper.profile.PlayerProfile createProfile(@Nullable UUID uuid, @Nullable String name);
@@ -482,6 +489,7 @@ index 0000000000000000000000000000000000000000..00000000000000000000000000000000
 +     * @param uuid UUID to create profile for
 +     * @param name Name to create profile for
 +     * @return A PlayerProfile object
++     * @throws IllegalArgumentException if the name is longer than 16 characters
 +     */
 +    @NotNull
 +    com.destroystokyo.paper.profile.PlayerProfile createProfileExact(@Nullable UUID uuid, @Nullable String name);

patches/server/Basic-PlayerProfile-API.patch

@@ -22,6 +22,7 @@ index 0000000000000000000000000000000000000000..00000000000000000000000000000000
 @@ -0,0 +0,0 @@
 +package com.destroystokyo.paper.profile;
 +
++import com.google.common.base.Preconditions;
 +import com.mojang.authlib.yggdrasil.ProfileResult;
 +import io.papermc.paper.configuration.GlobalConfiguration;
 +import com.google.common.base.Charsets;
@@ -76,6 +77,8 @@ index 0000000000000000000000000000000000000000..00000000000000000000000000000000
 +        String name = property.getName();
 +        PropertyMap properties = profile.getProperties();
 +        properties.removeAll(name);
++
++        Preconditions.checkArgument(properties.size() < 16, "Cannot add more than 16 properties to a profile");
 +        properties.put(name, new Property(name, property.getValue(), property.getSignature()));
 +    }
 +
@@ -165,10 +168,10 @@ index 0000000000000000000000000000000000000000..00000000000000000000000000000000
 +    @Nullable
 +    @Override
 +    public void setProperty(@NotNull String propertyName, @Nullable Property property) {
-+        PropertyMap properties = profile.getProperties();
-+        properties.removeAll(propertyName);
 +        if (property != null) {
-+            properties.put(propertyName, property);
++            this.setProperty(new ProfileProperty(propertyName, property.value(), property.signature()));
++        } else {
++            profile.getProperties().removeAll(propertyName);
 +        }
 +    }
 +
@@ -288,6 +291,7 @@ index 0000000000000000000000000000000000000000..00000000000000000000000000000000
 +    }
 +
 +    private static GameProfile createAuthLibProfile(UUID uniqueId, String name) {
++        Preconditions.checkArgument(name == null || name.length() <= 16, "Name cannot be longer than 16 characters");
 +        return new GameProfile(
 +            uniqueId != null ? uniqueId : Util.NIL_UUID,
 +            name != null ? name : ""

patches/server/Handle-Item-Meta-Inconsistencies.patch

@@ -271,3 +271,40 @@ index 0000000000000000000000000000000000000000..00000000000000000000000000000000
 +    // Paper end
 +
  }
+diff --git a/src/main/java/org/bukkit/craftbukkit/profile/CraftPlayerProfile.java b/src/main/java/org/bukkit/craftbukkit/profile/CraftPlayerProfile.java
+index 0000000000000000000000000000000000000000..0000000000000000000000000000000000000000 100644
+--- a/src/main/java/org/bukkit/craftbukkit/profile/CraftPlayerProfile.java
++++ b/src/main/java/org/bukkit/craftbukkit/profile/CraftPlayerProfile.java
+@@ -0,0 +0,0 @@ public final class CraftPlayerProfile implements PlayerProfile {
+         boolean isValidSkullProfile = (gameProfile.getName() != null)
+                 || gameProfile.getProperties().containsKey(CraftPlayerTextures.PROPERTY_NAME);
+         Preconditions.checkArgument(isValidSkullProfile, "The skull profile is missing a name or textures!");
++        // Paper start - Validate
++        Preconditions.checkArgument(gameProfile.getName().length() <= 16, "The name of the profile is longer than 16 characters");
++        final PropertyMap properties = gameProfile.getProperties();
++        Preconditions.checkArgument(properties.size() <= 16, "The profile contains more than 16 properties");
++        for (final Property property : properties.values()) {
++            Preconditions.checkArgument(property.name().length() <= 64, "The name of a property is longer than 64 characters");
++            Preconditions.checkArgument(property.value().length() <= Short.MAX_VALUE, "The value of a property is longer than 32767 characters");
++            Preconditions.checkArgument(property.signature() == null || property.signature().length() <= 1024, "The signature of a property is longer than 1024 characters");
++        }
++        // Paper end - Validate
+         return gameProfile;
+     }
+ 
+@@ -0,0 +0,0 @@ public final class CraftPlayerProfile implements PlayerProfile {
+ 
+     public CraftPlayerProfile(UUID uniqueId, String name) {
+         Preconditions.checkArgument((uniqueId != null) || !StringUtils.isBlank(name), "uniqueId is null or name is blank");
++        Preconditions.checkArgument(name == null || name.length() <= 16, "The name of the profile is longer than 16 characters"); // Paper - Validate
+         this.uniqueId = (uniqueId == null) ? Util.NIL_UUID : uniqueId;
+         this.name = (name == null) ? "" : name;
+     }
+@@ -0,0 +0,0 @@ public final class CraftPlayerProfile implements PlayerProfile {
+         // Assert: (property == null) || property.getName().equals(propertyName)
+         this.removeProperty(propertyName);
+         if (property != null) {
++            Preconditions.checkArgument(this.properties.size() < 16, "The profile contains more than 16 properties"); // Paper - Validate
+             this.properties.put(property.name(), property);
+         }
+     }