intellectualsites / plot2dynmap Goto Github PK

Plot2Dynmap dev 9
PlotSquared-Breaking dev 406

@boy0001 or @N0tMyFaultOG Please remove debug here. :)
0b93aef#diff-29b7475a377f50f9c7642c86562987a2R116

Server Implementation

Paper

Server Version

1.19

Describe the bug

There is a null pointer exception error when loading the latest Plot2Dynmap.jar on 1.19, which from what I can tell is not allowing the plugin to register all new plots correctly.

To Reproduce

1.) Load Plot2Dynmap on 1.19 Paper Server
2.) Watch console for error

Expected behaviour

1.) Load Plot2Dynmap on 1.19 Paper Server
2.) It loads with no errors

Screenshots / Videos

No response

Error log (if applicable)

https://paste.gg/p/anonymous/685505f896bb4b0c86b3e5adefea7c6e

Plot Debugpaste

https://athion.net/ISPaster/paste/view/66e38163c44240c281dd4e7544140c36

Plot2Dynmap Version

Plot2Dynmap 6.0.3

Checklist

• I have included a Plot debugpaste.
• I am using the newest build from https://www.spigotmc.org/resources/1292/ and the issue still persists.

Anything else?

No response

What feature do you want to see added?

This plugin is wonderful but does not work on paper1.17.1, PlotSquredv6.
Any updates for 1.17.1 will be appreciated.

Are there any alternatives?

No.

Anything else?

No response

Server Implementation

Paper

Server Version

1.18.2

Describe the bug

The Plot2Dynmap is not using PlotSquared's UUID cache, and seems to be doing them separate, which causes failure by being rate limited, this is not good for many reasons, so the plugin never loads all plots onto Dynmap either.

https://cmap.piratemc.com/

[17:06:12] [Craft Scheduler Thread - 19 - Plot2Dynmap/WARN]: [PlotSquared/UUIDPipeline] (UUID) Request for 17e45a64-6b9f-3f9c-99c8-ae4f767f1848 timed out. Rate limit.
[17:06:12] [Craft Scheduler Thread - 19 - Plot2Dynmap/WARN]: java.lang.NullPointerException: Cannot invoke "java.lang.CharSequence.toString()" because "replacement" is null
[17:06:12] [Craft Scheduler Thread - 19 - Plot2Dynmap/WARN]: 	at java.base/java.lang.String.replace(String.java:2956)
[17:06:12] [Craft Scheduler Thread - 19 - Plot2Dynmap/WARN]: 	at Plot2Dynmap-6.0.3.jar//com.plotsquared.plot2dynmap.Plot2DynmapPlugin.formatInfoWindow(Plot2DynmapPlugin.java:64)
[17:06:12] [Craft Scheduler Thread - 19 - Plot2Dynmap/WARN]: 	at Plot2Dynmap-6.0.3.jar//com.plotsquared.plot2dynmap.Plot2DynmapPlugin.handlePlot(Plot2DynmapPlugin.java:179)
[17:06:12] [Craft Scheduler Thread - 19 - Plot2Dynmap/WARN]: 	at Plot2Dynmap-6.0.3.jar//com.plotsquared.plot2dynmap.Plot2DynmapPlugin.run(Plot2DynmapPlugin.java:273)
[17:06:12] [Craft Scheduler Thread - 19 - Plot2Dynmap/WARN]: 	at org.bukkit.craftbukkit.v1_18_R2.scheduler.CraftTask.run(CraftTask.java:101)
[17:06:12] [Craft Scheduler Thread - 19 - Plot2Dynmap/WARN]: 	at org.bukkit.craftbukkit.v1_18_R2.scheduler.CraftAsyncTask.run(CraftAsyncTask.java:57)
[17:06:12] [Craft Scheduler Thread - 19 - Plot2Dynmap/WARN]: 	at com.destroystokyo.paper.ServerSchedulerReportingWrapper.run(ServerSchedulerReportingWrapper.java:22)
[17:06:12] [Craft Scheduler Thread - 19 - Plot2Dynmap/WARN]: 	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
[17:06:12] [Craft Scheduler Thread - 19 - Plot2Dynmap/WARN]: 	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
[17:06:12] [Craft Scheduler Thread - 19 - Plot2Dynmap/WARN]: 	at java.base/java.lang.Thread.run(Thread.java:833)

To Reproduce

1. Install plot2dynmap & dynmap
2. Have a lot of plots and use the plugin...

Expected behaviour

To use the existing cache and not get rate limited by mojang.

Screenshots / Videos

https://cmap.piratemc.com/

Error log (if applicable)

No response

Plot Debugpaste

https://athion.net/ISPaster/paste/view/8fc9247a4c6d451598719bd1ae6e41f3

Plot2Dynmap Version

6.0.3

Checklist

• I have included a Plot debugpaste.
• I am using the newest build from https://www.spigotmc.org/resources/1292/ and the issue still persists.

Anything else?

No response

What feature do you want to see added?

There should be class names relating to the infomation shown on these elerments

Are there any alternatives?

No

Anything else?

No response

WS-2021-0419 - High Severity Vulnerability

Vulnerable Library - gson-2.8.8.jar

Library home page: https://github.com/google/gson

Path to dependency file: Plot2Dynmap/build.gradle.kts

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.google.code.gson/gson/2.8.8/431fc3cbc0ff81abdbfde070062741089c3ba874/gson-2.8.8.jar

Dependency Hierarchy:

• paper-api-1.17.1-R0.1-SNAPSHOT.jar (Root Library)
  • ❌ gson-2.8.8.jar (Vulnerable Library)

Found in HEAD commit: ab44076448aa431e07f8fe5b74e9b702617b3571

Found in base branch: main

Vulnerability Details

Denial of Service vulnerability was discovered in gson before 2.8.9 via the writeReplace() method.

Publish Date: 2021-10-11

URL: WS-2021-0419

CVSS 3 Score Details (7.7)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/google/gson/releases/tag/gson-parent-2.8.9

Release Date: 2021-10-11

Fix Resolution: com.google.code.gson:gson:2.8.9

Step up your Open Source Security Game with WhiteSource here

Server Implementation

Paper

Server Version

1.19.3

Describe the bug

Plots2Dynmap creates a TON of dynmap markers. This is fine, but they should be created as non-persistent. Otherwise it will create a TON of persistent markers and clog up the database/file.

If dynmap is in file tree mode this may go unnoticed, but will wreck havoc in SQL mode. This is because Dynmap stores persistent markers as a single gigantic JSON object. This is not ideal (which I have reported here webbukkit/dynmap#3954), but should not be a problem here since the markers have no reason to be persistent in this case anyway.

The result of this is every time the markers are updated, it hangs the entire dynmap sql server for a while since it has to update this gigantic string. This results in dynmap sporadically being completely nonfunctional at best and never functional at worst.

To Reproduce

1. Install Plots2Dynmap (Preferrably with a large world)
2. Configure dynmap to use SQL (I used MySQL but im sure you'd get the same result with sqlite)
3. perform a dynmap fullrender
4. Watch as the row in dynmap.MarkerFiles grows to an insane size, as all of the markers are being created as persistent

Expected behaviour

Markers are created as non-persistent and therefore do not explode the database

Screenshots / Videos

No response

Error log (if applicable)

No response

Plot Debugpaste

https://athion.net/ISPaster/paste/view/40ff9624b74145d6a3d3b409198c9ff2

Plot2Dynmap Version

6.0.3

Checklist

• I have included a Plot debugpaste.
• I am using the newest build from https://www.spigotmc.org/resources/1292/ and the issue still persists.

Anything else?

Server is 1.19.4 but that was not an option in the drop down

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• Update dependency com.sk89q.worldedit:worldedit-bukkit to v7.3.3

Ignored or Blocked

These are blocked by an existing closed PR and will not be recreated unless you click a checkbox below.

• Update actions/upload-artifact action to v4

Detected dependencies

• Check this box to trigger a request for Renovate to run again on this repository

Server Implementation

Tested against Airplane Purpur branch but also affects all other Paper derivatives.

Server Version

1.16.5

Describe the bug

Going around testing plugins before 1.17's release and forced Java 16 update. Figured I'd let you know of this small incompatibility probably known about before v6's release.

[14:04:52] [Craft Scheduler Thread - 21 - Plot2Dynmap/WARN]: [Plot2Dynmap] Plugin Plot2Dynmap v5.2 generated an exception while executing task 6474
java.lang.NoSuchMethodError: 'boolean com.plotsquared.core.PlotSquared.hasPlotArea(java.lang.String)'
	at com.empcraft.plot2dynmap.Main.run(Main.java:194) ~[?:?]
	at org.bukkit.craftbukkit.v1_16_R3.scheduler.CraftTask.run(CraftTask.java:100) ~[patched_1.16.5.jar:git-Airplane-"1cf4e79"]
	at org.bukkit.craftbukkit.v1_16_R3.scheduler.CraftAsyncTask.run(CraftAsyncTask.java:58) ~[patched_1.16.5.jar:git-Airplane-"1cf4e79"]
	at com.destroystokyo.paper.ServerSchedulerReportingWrapper.run(ServerSchedulerReportingWrapper.java:22) ~[patched_1.16.5.jar:git-Airplane-"1cf4e79"]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1130) [?:?]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:630) [?:?]
	at java.lang.Thread.run(Thread.java:831) [?:?]

To Reproduce

1. Install PlotSquared v6
2. Install Plot2Dynmap
3. Incompatibility.

Expected behaviour

Compatibility with v6 P2.

Screenshots / Videos

No response

Error log (if applicable)

No response

Plot Debugpaste

Irrelevant to report.

Plot2Dynmap Version

Plot2Dynmap dev 48

Checklist

• [] I have included a Plot debugpaste.
• I am using the newest build from https://www.spigotmc.org/resources/1292/ and the issue still persists.

Anything else?

No response

CVE-2020-15250 - Medium Severity Vulnerability

Vulnerable Library - junit-4.10.jar

JUnit is a regression testing framework written by Erich Gamma and Kent Beck. It is used by the developer who implements unit tests in Java.

Library home page: http://junit.org

Path to dependency file: Plot2Dynmap/build.gradle.kts

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/junit/junit/4.10/e4f1766ce7404a08f45d859fb9c226fc9e41a861/junit-4.10.jar

Dependency Hierarchy:

• paper-api-1.17.1-R0.1-SNAPSHOT.jar (Root Library)
  • json-simple-1.1.1.jar
    • ❌ junit-4.10.jar (Vulnerable Library)

Found in HEAD commit: ab44076448aa431e07f8fe5b74e9b702617b3571

Found in base branch: main

Vulnerability Details

In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this directory they are, by default, readable by other users on that same system. This vulnerability does not allow other users to overwrite the contents of these directories or files. This is purely an information disclosure vulnerability. This vulnerability impacts you if the JUnit tests write sensitive information, like API keys or passwords, into the temporary folder, and the JUnit tests execute in an environment where the OS has other untrusted users. Because certain JDK file system APIs were only added in JDK 1.7, this this fix is dependent upon the version of the JDK you are using. For Java 1.7 and higher users: this vulnerability is fixed in 4.13.1. For Java 1.6 and lower users: no patch is available, you must use the workaround below. If you are unable to patch, or are stuck running on Java 1.6, specifying the java.io.tmpdir system environment variable to a directory that is exclusively owned by the executing user will fix this vulnerability. For more information, including an example of vulnerable code, see the referenced GitHub Security Advisory.

Publish Date: 2020-10-12

URL: CVE-2020-15250

CVSS 3 Score Details (5.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-269g-pwp5-87pp

Release Date: 2020-10-12

Fix Resolution: junit:junit:4.13.1

Step up your Open Source Security Game with WhiteSource here

Server Implementation

Paper

Server Version

1.18.1

Describe the bug

It appears that the existing plots aren't rendered as they should be. Upon server start there is an error in the logs as described in the paste.gg called error2 and after a while a second error appears here called error. Lastly appears sporadic and i don't have steps to reproduce it.

To Reproduce

1. upload plot2dynmap
2. make sure dynmap is installed
3. start server with existing plots
4. observe some plot overlays are rendered like in the screenshot
5. observe logs for the output

Expected behaviour

Plots are rendered completely after server is up and running not just a fraction of the plots.

Screenshots / Videos

Error log (if applicable)

https://paste.gg/p/anonymous/037bca559a3649beafe13ec9557154 https://paste.gg/p/anonymous/12fbe04423d24205af33946fb3e67a41de

Plot Debugpaste

https://athion.net/ISPaster/paste/view/26c2f3c1dad74f65b1ce009fcac9ec08

Plot2Dynmap Version

Plot2Dynmap v6.0.2

Checklist

• I have included a Plot debugpaste.
• I am using the newest build from https://www.spigotmc.org/resources/1292/ and the issue still persists.

Anything else?

No response

Hi,

Plot2Dynmap does not work with Paper 1.14.4 :

https://pastebin.com/SARv6RDd

This error comes back every 5min.

I use PaperSpigot 1.14.4 (version 230), PlotSquared 4.409, Dynmap 3.0 beta 5 and the new version of Plot2Dynmap for 1.13 & 1.14.

Server Implementation

Paper

Server Version

1.17.1

Describe the bug

As you can see on my map https://map.ofunny.world/citybuild (switched to Squaremap) some merged plots render sub markers in shape of the road in between them or in shape of old single plots (before the merge).
While PS works fine, I also checked the data in my MySql database what also seems to be valid.
So I guess there is something wrong with Plot2Dynmap.

Note: I'm using LiveAtlas to display Dynmap but I also tested it with the original Dynmap web interface, same result.

To Reproduce

1. Open https://map.ofunny.world/citybuild (switched to Squaremap)
2. Scroll out a little bit
3. Compare the markers of the merged plots (one is correct, two are weird)

Expected behaviour

Rendering merged plots as one marker only.

Screenshots / Videos

Error log (if applicable)

No errors appear in the log

Plot Debugpaste

https://athion.net/ISPaster/paste/view/07db609057d3425b85fddd97d85b3438

Plot2Dynmap Version

Plot2Dynmap 6.0.1

Checklist

• I have included a Plot debugpaste.
• I am using the newest build from https://www.spigotmc.org/resources/1292/ and the issue still persists.

Anything else?

No response

Server Implementation

Paper

Server Version

1.18.2

Describe the bug

When I claim a plot then set the owned by server flag on it. It still shown as owned by me

To Reproduce

1. Claim a plot in game
2. Set the server flag with /p flags server true
3. Reload server
4. Click on plot on dymap
5. See that original claim player is still the owner

Expected behaviour

Should show owner as -Server- (dashes are to avoid username conflict as they can't be used in names) and follow custom -Server- style from config

Screenshots / Videos

No response

Error log (if applicable)

No response

Plot Debugpaste

https://athion.net/ISPaster/paste/view/b14426e2d9204b5fa5fdfa398778d5fd

Plot2Dynmap Version

6.0.3

Checklist

• I have included a Plot debugpaste.
• I am using the newest build from https://www.spigotmc.org/resources/1292/ and the issue still persists.

Anything else?

No response