[Zerp7]

Overview

Minecraft 1.20.5 through 1.21.4 contain unfixable Vanilla protocol exploits related to container clicks. Even when running on 1.21.5+ backend servers, parsing and converting item data sent by these clients still exposes ViaVersion to vulnerabilities:
ViaVersion/ViaVersion@3afc3ee

This PR adds an option to discard client-provided click items entirely and replace them with empty dummy data, bypassing item conversion to prevent ViaVersion from being exposed to these exploits.

What this does

• Drops client-sent item data from CONTAINER_CLICK packets for 1.20.5–1.21.4 clients and writes empty data instead.
• Bitwise-inverts the state ID (stateId ^ 1) to intentionally cause a mismatch, forcing the server to resynchronize the client's inventory.
• Introduces the ignore-1_20_5-1_21_4-click-items config option to control this behavior.

Notes for Server Owners

• Accepting the risk / Restoring legacy behavior: If you rely on the original behavior and are willing to accept the risk of these protocol exploits, keep this option disabled (false) in the config.
• Alternative workaround: If you don't actually need to support 1.20.5–1.21.4, we recommend simply adding these versions to block-versions in your ViaVersion configuration.

[roccodev]

I'm not the requested reviewer but I'd just like to leave my two cents, I sincerely doubt this is needed at all.

First of all, items in serverbound packets aren't new to 1.20.5, they're there in all prior versions Via supports, so this still leaves potential exploits open to older versions that get their items passed through the 1.20.5 protocol. Not to mention this would also affect ViaVersion on servers older than that.

I believe the warning was primarily added to warn 1.20.5-1.21.4 server owners which are fully affected, in my opinion the rest of the warning is just a no-warranty notice for 1.20.5-1.21.4 connections, which basically says "if there is an exploit for these versions, you're on your own".

In the current state of things, I don't believe Via to be exploitable by those versions with serious consequences. The really untrusted part of item data is text components, this has been the case since forever (e.g. 1.8 book exploit). In particular, 1.20.5 exposes a vulnerability that allows specially crafted translatable components to resolve on the server to an oversized string from a payload that fits within protocol limits. This relies on the server flattening the component and resolving the (recursive) translation parameters. Via does not do this (and rightfully so, resolving the translation would result in different hashes depending on client locale), the most it does is replace the translation key. And even if you make a really nested text component, this currently gets blocked by gson deserialization.

Now I definitely can't exclude there may be other exploits that rely on the new item components format, and it's definitely true that item hashes are the better way to handle this, but in general I do feel like this is making a bigger deal than this actually is. Though if anyone has more information about this, I'd love to hear :)

[Zerp7]

I cannot share specific reproduction details or payloads publicly, as doing so would put a large number of production servers running ViaVersion at immediate risk of crashing.

To address your assumptions, 1.20.4 and older clients are not affected by this.