Merge branch 'stable' into next-minor

changelogs/3.27.md

@@ -0,0 +1,15 @@
+**For Minecraft: Bedrock Edition 1.18.0**
+
+### Note about API versions
+Plugins which don't touch the protocol and compatible with any previous 3.x.y version will also run on these releases and do not need API bumps.
+Plugin developers should **only** update their required API to this version if you need the changes in this build.
+
+**WARNING: If your plugin uses the protocol, you're not shielded by API change constraints.** You should consider using the `mcpe-protocol` directive in `plugin.yml` as a constraint if you do.
+
+# 3.27.0
+- Introduced support for protocol encryption.
+  - Encryption is enabled by default.
+  - Fixes login replay attacks.
+  - This may cause some performance degradation.
+  - Encryption can be disabled by setting `network.enable-encryption` to `false` in `pocketmine.yml`. DO NOT do this unless you understand the risks involved.
+- An obsoletion notice has been added to the console during server startup.

changelogs/4.0.md

@@ -1607,3 +1607,16 @@ Released 13th January 2022.
 ## Fixes
 - Fixed server crash on invalid facing values provided by the client when placing or breaking blocks.
 - Fixed documentation link to AsyncTask in Worker.
+
+# 4.0.7
+Released 21st January 2022.
+
+## General
+- Max nesting of form responses is now limited to 2.
+- Updated outdated documentation of `PlayerInteractEvent`.
+
+## Fixes
+- Fixed server crash on invalid JSON provided by the client in `ModalFormResponsePacket`.
+- Fixed ender pearls teleporting players when thrown by a player directly against a wall when cancelling `ProjectileLaunchEvent`.
+- Fixed collision box of brewing stand.
+- Fixed break times and tool types of bamboo, nether wart blocks, infested stone and leaves.

composer.lock

@@ -1467,9 +1467,6 @@
             "require": {
                 "php": "^7.1 || ^8.0"
             },
-            "replace": {
-                "myclabs/deep-copy": "self.version"
-            },
             "require-dev": {
                 "doctrine/collections": "^1.0",
                 "doctrine/common": "^2.6",
@@ -2392,16 +2389,16 @@
         },
         {
             "name": "phpunit/phpunit",
-            "version": "9.5.11",
+            "version": "9.5.12",
             "source": {
                 "type": "git",
                 "url": "https://github.com/sebastianbergmann/phpunit.git",
-                "reference": "2406855036db1102126125537adb1406f7242fdd"
+                "reference": "93d4bf4c37aec6384bb9e5d390d9049a463a7256"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/sebastianbergmann/phpunit/zipball/2406855036db1102126125537adb1406f7242fdd",
-                "reference": "2406855036db1102126125537adb1406f7242fdd",
+                "url": "https://api.github.com/repos/sebastianbergmann/phpunit/zipball/93d4bf4c37aec6384bb9e5d390d9049a463a7256",
+                "reference": "93d4bf4c37aec6384bb9e5d390d9049a463a7256",
                 "shasum": ""
             },
             "require": {
@@ -2479,7 +2476,7 @@
             ],
             "support": {
                 "issues": "https://github.com/sebastianbergmann/phpunit/issues",
-                "source": "https://github.com/sebastianbergmann/phpunit/tree/9.5.11"
+                "source": "https://github.com/sebastianbergmann/phpunit/tree/9.5.12"
             },
             "funding": [
                 {
@@ -2491,7 +2488,7 @@
                     "type": "github"
                 }
             ],
-            "time": "2021-12-25T07:07:57+00:00"
+            "time": "2022-01-21T05:54:47+00:00"
         },
         {
             "name": "sebastian/cli-parser",

src/network/mcpe/handler/InGamePacketHandler.php

@@ -118,7 +118,6 @@ use function is_infinite;
 use function is_nan;
 use function json_decode;
 use function json_encode;
-use function json_last_error_msg;
 use function max;
 use function mb_strlen;
 use function microtime;
@@ -128,11 +127,13 @@ use function strlen;
 use function strpos;
 use function substr;
 use function trim;
+use const JSON_THROW_ON_ERROR;
 
 /**
  * This handler handles packets related to general gameplay.
  */
 class InGamePacketHandler extends PacketHandler{
+	private const MAX_FORM_RESPONSE_DEPTH = 2; //modal/simple will be 1, custom forms 2 - they will never contain anything other than string|int|float|bool|null
 
 	/** @var Player */
 	private $player;
@@ -918,14 +919,18 @@ class InGamePacketHandler extends PacketHandler{
 			}
 
 			$fixed = "[" . implode(",", $newParts) . "]";
-			if(($ret = json_decode($fixed, $assoc)) === null){
-				throw new \InvalidArgumentException("Failed to fix JSON: " . json_last_error_msg() . "(original: $json, modified: $fixed)");
+			try{
+				return json_decode($fixed, $assoc, self::MAX_FORM_RESPONSE_DEPTH, JSON_THROW_ON_ERROR);
+			}catch(\JsonException $e){
+				throw PacketHandlingException::wrap($e, "Failed to fix JSON (original: $json, modified: $fixed)");
 			}
-
-			return $ret;
 		}
 
-		return json_decode($json, $assoc);
+		try{
+			return json_decode($json, $assoc, self::MAX_FORM_RESPONSE_DEPTH, JSON_THROW_ON_ERROR);
+		}catch(\JsonException $e){
+			throw PacketHandlingException::wrap($e);
+		}
 	}
 
 	public function handleServerSettingsRequest(ServerSettingsRequestPacket $packet) : bool{

tests/phpunit/network/mcpe/handler/StupidJsonDecodeTest.php

@@ -45,7 +45,7 @@ class StupidJsonDecodeTest extends TestCase{
 			["[\n   \"a\",\"b,c,d,e\\\"   \",,0,1,2, false, 0.001]", ['a', 'b,c,d,e"   ', '', 0, 1, 2, false, 0.001]],
 			["0", 0],
 			["false", false],
-			["NULL", null],
+			["null", null],
 			['["\",,\"word","a\",,\"word2",]', ['",,"word', 'a",,"word2', '']],
 			['["\",,\"word","a\",,\"word2",""]', ['",,"word', 'a",,"word2', '']],
 			['["Hello,, PocketMine"]', ['Hello,, PocketMine']],