From a17512de9388439c9dd6364e15873d4a67263e3a Mon Sep 17 00:00:00 2001
From: "Dylan K. Taylor" <dktapps@pmmp.io>
Date: Mon, 6 Jan 2025 23:26:13 +0000
Subject: [PATCH] Command: don't trust plugins not to pass junk

---
 src/command/Command.php | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/command/Command.php b/src/command/Command.php
index 63276a123..aea57e6a2 100644
--- a/src/command/Command.php
+++ b/src/command/Command.php
@@ -33,6 +33,7 @@ use pocketmine\permission\PermissionManager;
 use pocketmine\Server;
 use pocketmine\utils\BroadcastLoggerForwarder;
 use pocketmine\utils\TextFormat;
+use function array_values;
 use function explode;
 use function implode;
 use function str_replace;
@@ -213,6 +214,7 @@ abstract class Command{
 	 * @phpstan-param list<string> $aliases
 	 */
 	public function setAliases(array $aliases) : void{
+		$aliases = array_values($aliases); //because plugins can and will pass crap
 		$this->aliases = $aliases;
 		if(!$this->isRegistered()){
 			$this->activeAliases = $aliases;