UI 模块 handLocked 选项存在漏洞

[Neige7]

event.getClick() == ClickType.DOUBLE_CLICK 吸走主手的可堆叠物品
event.getClick() == ClickType.SHIFT_LEFT || event.getClick() == ClickType.SHIFT_RIGHT 点击上方容器内的同类物品，改变手持物品的堆叠数量
InventoryDragEvent 拖动同类物品，改变手持物品的堆叠数量

[Bkm016]

@claude

[claude]

Claude finished @Bkm016's task —— View job • claude/issue-374-20250806-1749 • Create PR ➔

---

UI Module handLocked Vulnerability - Security Fix Implemented ✅

I've successfully analyzed and fixed the security vulnerability in the UI module's handLocked option. The issue allowed players to bypass inventory restrictions through specific click and drag operations.

Todo List:

• Read repository guidelines (CLAUDE.md)
• Locate UI module and handLocked implementation code
• Analyze current vulnerability points
• Implement fixes for the three exploit scenarios
• Commit and create PR

Vulnerability Analysis

Original Problem: The handLocked feature in ClickListener.kt only protected against:

• Direct clicks on held item slot
• Number key swaps to held item slot

Three Exploit Methods Fixed:

1. Double-click exploit: ClickType.DOUBLE_CLICK could collect stackable items to cursor
2. Shift-click exploit: ClickType.SHIFT_LEFT/SHIFT_RIGHT could quick-move items
3. Drag exploit: InventoryDragEvent had no handLocked protection at all

Security Fixes Applied

Fix 1 - Enhanced Click Protection (ClickListener.kt:62-65):

// 锁定主手时禁止双击和shift点击操作
if (builder.handLocked && (e.click == org.bukkit.event.inventory.ClickType.DOUBLE_CLICK || 
    e.click == org.bukkit.event.inventory.ClickType.SHIFT_LEFT || 
    e.click == org.bukkit.event.inventory.ClickType.SHIFT_RIGHT)) {
    e.isCancelled = true
}

Fix 2 - Drag Event Protection (ClickListener.kt:109-113):

// 锁定主手时禁止拖拽操作
if (menu.handLocked) {
    e.isCancelled = true
    return
}

Changes Made:

• module/bukkit/bukkit-ui/src/main/kotlin/taboolib/module/ui/ClickListener.kt
  • Added protection against DOUBLE_CLICK, SHIFT_LEFT, SHIFT_RIGHT click types
  • Added handLocked check in onDrag method to prevent drag exploit
  • Maintains backward compatibility with existing functionality

The fixes ensure that when handLocked is enabled, all three exploit methods are properly blocked, preventing players from manipulating inventory state through these bypass techniques.

---

[zhibeigg]

#612 已修复