Release 4.23.1

ProcessLoginTask: fixed backport errors
Harden login EC key validation
2025-09-13 04:45:08 +00:00 · 2023-07-14 13:06:26 +01:00 · 2023-07-14 12:37:50 +01:00 · 2023-07-14 11:55:47 +01:00 · 2023-07-14 11:54:05 +01:00 · 2023-07-12 13:44:16 +01:00
16 changed files with 238 additions and 91 deletions
--- a/.github/workflows/draft-release.yml
+++ b/.github/workflows/draft-release.yml
@ -84,3 +84,5 @@ jobs:
            **For Minecraft: Bedrock Edition ${{ steps.get-pm-version.outputs.MCPE_VERSION }}**

            Please see the [changelogs](${{ github.server_url }}/${{ github.repository }}/blob/${{ steps.get-pm-version.outputs.PM_VERSION }}/changelogs/${{ steps.get-pm-version.outputs.PM_VERSION_SHORT }}${{ steps.get-pm-version.outputs.CHANGELOG_SUFFIX }}.md#${{ steps.get-pm-version.outputs.PM_VERSION_MD }}) for details.
+
+            :warning: **4.x is now deprecated. Please read https://github.com/pmmp/PocketMine-MP/issues/5784 for details, and prepare to upgrade to 5.x.**
--- a/.github/workflows/update-updater-api.yml
+++ b/.github/workflows/update-updater-api.yml
@ -8,6 +8,7 @@ on:
 jobs:
  build:
    runs-on: ubuntu-latest
+    concurrency: update-updater-api # only one job can run at a time, to avoid git conflicts when updating the repository

    steps:
      - name: Install jq
--- a/build/php
+++ b/build/php
--- a/changelogs/4.22.md
+++ b/changelogs/4.22.md
@ -27,8 +27,32 @@ If you're upgrading from 4.20.x directly to 4.22.x, please also read the followi
 Released 9th June 2023.

 ## Fixes
- Reokaced workaround for an old teleporting client bug:
+- Replaced workaround for an old teleporting client bug:
  - This workaround broke due to an additional client bug introduced by 1.20, causing players to become frozen to observers when teleported.
  - The original client bug has still not been fixed, meaning a new workaround was needed, but no perfect solution could be found.
  - The new workaround involves broadcasting teleport movements as regular movements, which causes unwanted interpolation between the old and new positions, but otherwise works correctly. This solution is not ideal, but it is the best we can do for now.
  - See issues [#4394](https://github.com/pmmp/PocketMine-MP/issues/4394) and [#5810](https://github.com/pmmp/PocketMine-MP/issues/5810) for more details.
+
+# 4.22.2
+Released 1st July 2023.
+
+## Changes
+- Added obsoletion warnings to the server log at the end of the startup sequence.
+
+## Fixes
+- Fixed players being disconnected en masse with "Not authenticated" messages.
+  - This occurred due to a check intended to disable the old authentication key after July 1st.
+  - We expected that the new key would have been deployed by Mojang by now, but it seems like that has not yet happened.
+  - Due to the lack of a hard date for the key changeover, we guessed that July 1st would be a safe bet, but this appears to have backfired.
+  - This version will accept both old and new keys indefinitely.
+  - A security release will be published to remove the old key after the transition occurs.
+
+# 4.22.3
+Released 11th July 2023.
+
+## Fixes
+- Fixed mishandling of NBT leading to a server crash when editing signs.
+- Fixed an edge case crash that could occur in `AsyncTask->__destruct()` when thread-local storage referenced other `AsyncTask` objects.
+
+## Internals
+- Added a concurrency lock to prevent the `update-updater-api` GitHub Action from running for multiple releases at the same time (which would have caused one of them to fail due to git conflicts).
--- a/changelogs/4.23.md
+++ b/changelogs/4.23.md
@ -0,0 +1,26 @@
+# 4.23.0
+Released 12th July 2023.
+
+**For Minecraft: Bedrock Edition 1.20.10**
+
+This is a support release for Minecraft: Bedrock Edition 1.20.10.
+
+**Plugin compatibility:** Plugins for previous 4.x versions will run unchanged on this release, unless they use internal APIs, reflection, or packages like the `pocketmine\network\mcpe` namespace.
+Do not update plugin minimum API versions unless you need new features added in this release.
+
+**WARNING: If your plugin uses the `pocketmine\network\mcpe` namespace, you're not shielded by API change constraints.**
+Consider using the `mcpe-protocol` directive in `plugin.yml` as a constraint if you're using packets directly.
+
+## General
+- Added support for Minecraft: Bedrock Edition 1.20.10.
+- Removed support for older versions.
+
+## Fixes
+- Fixed Docker image build failure due to outdated `build/php` submodule.
+
+# 4.23.1
+Released 14th July 2023.
+
+## Fixes
+- Hardened validation of JWT signing keys in `LoginPacket`.
+- Fixed server crash due to a bug in upstream dependency [`netresearch/jsonmapper`](https://github.com/cweiske/JsonMapper).
--- a/composer.json
+++ b/composer.json
@ -31,13 +31,13 @@
      "ext-zip": "*",
      "ext-zlib": ">=1.2.11",
      "composer-runtime-api": "^2.0",
-      "adhocore/json-comment": "^1.1",
-      "fgrosse/phpasn1": "^2.3",
-      "pocketmine/netresearch-jsonmapper": "~v4.2.999",
-      "pocketmine/bedrock-block-upgrade-schema": "~2.2.0+bedrock-1.20.0",
-      "pocketmine/bedrock-data": "~2.3.0+bedrock-1.20.0",
-      "pocketmine/bedrock-item-upgrade-schema": "~1.3.0+bedrock-1.20.0",
-      "pocketmine/bedrock-protocol": "~22.0.0+bedrock-1.20.0",
+      "adhocore/json-comment": "~1.2.0",
+      "fgrosse/phpasn1": "~2.5.0",
+      "pocketmine/netresearch-jsonmapper": "~v4.2.1000",
+      "pocketmine/bedrock-block-upgrade-schema": "~3.1.0+bedrock-1.20.10",
+      "pocketmine/bedrock-data": "~2.4.0+bedrock-1.20.10",
+      "pocketmine/bedrock-item-upgrade-schema": "~1.4.0+bedrock-1.20.10",
+      "pocketmine/bedrock-protocol": "~23.0.0+bedrock-1.20.10",
      "pocketmine/binaryutils": "^0.2.1",
      "pocketmine/callback-validator": "^1.0.2",
      "pocketmine/classloader": "^0.2.0",
@ -51,9 +51,9 @@
      "pocketmine/raklib": "^0.14.2",
      "pocketmine/raklib-ipc": "^0.1.0",
      "pocketmine/snooze": "^0.3.0",
-      "ramsey/uuid": "^4.1",
-      "symfony/filesystem": "^5.4",
-      "webmozart/path-util": "^2.3"
+      "ramsey/uuid": "~4.7.0",
+      "symfony/filesystem": "~5.4.0",
+      "webmozart/path-util": "~2.3.0"
   },
   "require-dev": {
      "phpstan/phpstan": "1.10.15",
--- a/composer.lock
+++ b/composer.lock
@ -4,7 +4,7 @@
        "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
        "This file is @generated automatically"
    ],
-    "content-hash": "fcfde015c4c61d0a422234b5858b98a7",
+    "content-hash": "4524eed9bd1a33e650413fbf41382e20",
    "packages": [
        {
            "name": "adhocore/json-comment",
@ -198,16 +198,16 @@
        },
        {
            "name": "pocketmine/bedrock-block-upgrade-schema",
-            "version": "2.2.0",
+            "version": "3.1.0",
            "source": {
                "type": "git",
                "url": "https://github.com/pmmp/BedrockBlockUpgradeSchema.git",
-                "reference": "79bb3ad542ef19e828fdf1fa6adc54f1fa4b3bb5"
+                "reference": "6d4ae416043337946a22fc31e8065ca2c21f472d"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/pmmp/BedrockBlockUpgradeSchema/zipball/79bb3ad542ef19e828fdf1fa6adc54f1fa4b3bb5",
-                "reference": "79bb3ad542ef19e828fdf1fa6adc54f1fa4b3bb5",
+                "url": "https://api.github.com/repos/pmmp/BedrockBlockUpgradeSchema/zipball/6d4ae416043337946a22fc31e8065ca2c21f472d",
+                "reference": "6d4ae416043337946a22fc31e8065ca2c21f472d",
                "shasum": ""
            },
            "type": "library",
@ -218,22 +218,22 @@
            "description": "Schemas describing how to upgrade saved block data in older Minecraft: Bedrock Edition world saves",
            "support": {
                "issues": "https://github.com/pmmp/BedrockBlockUpgradeSchema/issues",
-                "source": "https://github.com/pmmp/BedrockBlockUpgradeSchema/tree/2.2.0"
+                "source": "https://github.com/pmmp/BedrockBlockUpgradeSchema/tree/3.1.0"
            },
-            "time": "2023-05-04T21:49:36+00:00"
+            "time": "2023-07-12T12:05:36+00:00"
        },
        {
            "name": "pocketmine/bedrock-data",
-            "version": "2.3.0+bedrock-1.20.0",
+            "version": "2.4.0+bedrock-1.20.10",
            "source": {
                "type": "git",
                "url": "https://github.com/pmmp/BedrockData.git",
-                "reference": "b3dd3f4b8e3b6759c5d84de6ec85bb20b668c3a9"
+                "reference": "f98bd1cae46d2920058acf3b23c0bedeac79f4ab"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/pmmp/BedrockData/zipball/b3dd3f4b8e3b6759c5d84de6ec85bb20b668c3a9",
-                "reference": "b3dd3f4b8e3b6759c5d84de6ec85bb20b668c3a9",
+                "url": "https://api.github.com/repos/pmmp/BedrockData/zipball/f98bd1cae46d2920058acf3b23c0bedeac79f4ab",
+                "reference": "f98bd1cae46d2920058acf3b23c0bedeac79f4ab",
                "shasum": ""
            },
            "type": "library",
@ -244,22 +244,22 @@
            "description": "Blobs of data generated from Minecraft: Bedrock Edition, used by PocketMine-MP",
            "support": {
                "issues": "https://github.com/pmmp/BedrockData/issues",
-                "source": "https://github.com/pmmp/BedrockData/tree/bedrock-1.20.0"
+                "source": "https://github.com/pmmp/BedrockData/tree/bedrock-1.20.10"
            },
-            "time": "2023-06-07T19:06:47+00:00"
+            "time": "2023-07-12T11:51:54+00:00"
        },
        {
            "name": "pocketmine/bedrock-item-upgrade-schema",
-            "version": "1.3.0",
+            "version": "1.4.0",
            "source": {
                "type": "git",
                "url": "https://github.com/pmmp/BedrockItemUpgradeSchema.git",
-                "reference": "b16c59cfae08833f180dd82f88de7c1f43bc67c9"
+                "reference": "60d199afe5e371fd189b21d685ec1fed6ba54230"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/pmmp/BedrockItemUpgradeSchema/zipball/b16c59cfae08833f180dd82f88de7c1f43bc67c9",
-                "reference": "b16c59cfae08833f180dd82f88de7c1f43bc67c9",
+                "url": "https://api.github.com/repos/pmmp/BedrockItemUpgradeSchema/zipball/60d199afe5e371fd189b21d685ec1fed6ba54230",
+                "reference": "60d199afe5e371fd189b21d685ec1fed6ba54230",
                "shasum": ""
            },
            "type": "library",
@ -270,22 +270,22 @@
            "description": "JSON schemas for upgrading items found in older Minecraft: Bedrock world saves",
            "support": {
                "issues": "https://github.com/pmmp/BedrockItemUpgradeSchema/issues",
-                "source": "https://github.com/pmmp/BedrockItemUpgradeSchema/tree/1.3.0"
+                "source": "https://github.com/pmmp/BedrockItemUpgradeSchema/tree/1.4.0"
            },
-            "time": "2023-05-18T15:34:32+00:00"
+            "time": "2023-07-12T12:08:37+00:00"
        },
        {
            "name": "pocketmine/bedrock-protocol",
-            "version": "22.0.0+bedrock-1.20.0",
+            "version": "23.0.0+bedrock-1.20.10",
            "source": {
                "type": "git",
                "url": "https://github.com/pmmp/BedrockProtocol.git",
-                "reference": "ceff28a0bd5d248f37fb97be3e836d536e37526e"
+                "reference": "0cfaafdc02cca882a50773d6c02ebfeb622614e2"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/pmmp/BedrockProtocol/zipball/ceff28a0bd5d248f37fb97be3e836d536e37526e",
-                "reference": "ceff28a0bd5d248f37fb97be3e836d536e37526e",
+                "url": "https://api.github.com/repos/pmmp/BedrockProtocol/zipball/0cfaafdc02cca882a50773d6c02ebfeb622614e2",
+                "reference": "0cfaafdc02cca882a50773d6c02ebfeb622614e2",
                "shasum": ""
            },
            "require": {
@ -317,9 +317,9 @@
            "description": "An implementation of the Minecraft: Bedrock Edition protocol in PHP",
            "support": {
                "issues": "https://github.com/pmmp/BedrockProtocol/issues",
-                "source": "https://github.com/pmmp/BedrockProtocol/tree/22.0.0+bedrock-1.20.0"
+                "source": "https://github.com/pmmp/BedrockProtocol/tree/23.0.0+bedrock-1.20.10"
            },
-            "time": "2023-06-07T19:22:05+00:00"
+            "time": "2023-07-12T12:19:40+00:00"
        },
        {
            "name": "pocketmine/binaryutils",
@ -730,16 +730,16 @@
        },
        {
            "name": "pocketmine/netresearch-jsonmapper",
-            "version": "v4.2.999",
+            "version": "v4.2.1000",
            "source": {
                "type": "git",
                "url": "https://github.com/pmmp/netresearch-jsonmapper.git",
-                "reference": "f700806dec756ed825a8200dc2950ead98265956"
+                "reference": "078764e869e9b732f97206ec9363480a77c35532"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/pmmp/netresearch-jsonmapper/zipball/f700806dec756ed825a8200dc2950ead98265956",
-                "reference": "f700806dec756ed825a8200dc2950ead98265956",
+                "url": "https://api.github.com/repos/pmmp/netresearch-jsonmapper/zipball/078764e869e9b732f97206ec9363480a77c35532",
+                "reference": "078764e869e9b732f97206ec9363480a77c35532",
                "shasum": ""
            },
            "require": {
@ -778,9 +778,9 @@
            "support": {
                "email": "cweiske@cweiske.de",
                "issues": "https://github.com/cweiske/jsonmapper/issues",
-                "source": "https://github.com/pmmp/netresearch-jsonmapper/tree/v4.2.999"
+                "source": "https://github.com/pmmp/netresearch-jsonmapper/tree/v4.2.1000"
            },
-            "time": "2023-06-01T13:43:01+00:00"
+            "time": "2023-07-14T10:44:14+00:00"
        },
        {
            "name": "pocketmine/raklib",
@ -1089,16 +1089,16 @@
        },
        {
            "name": "symfony/filesystem",
-            "version": "v5.4.23",
+            "version": "v5.4.25",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/filesystem.git",
-                "reference": "b2f79d86cd9e7de0fff6d03baa80eaed7a5f38b5"
+                "reference": "0ce3a62c9579a53358d3a7eb6b3dfb79789a6364"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/filesystem/zipball/b2f79d86cd9e7de0fff6d03baa80eaed7a5f38b5",
-                "reference": "b2f79d86cd9e7de0fff6d03baa80eaed7a5f38b5",
+                "url": "https://api.github.com/repos/symfony/filesystem/zipball/0ce3a62c9579a53358d3a7eb6b3dfb79789a6364",
+                "reference": "0ce3a62c9579a53358d3a7eb6b3dfb79789a6364",
                "shasum": ""
            },
            "require": {
@ -1133,7 +1133,7 @@
            "description": "Provides basic utilities for the filesystem",
            "homepage": "https://symfony.com",
            "support": {
-                "source": "https://github.com/symfony/filesystem/tree/v5.4.23"
+                "source": "https://github.com/symfony/filesystem/tree/v5.4.25"
            },
            "funding": [
                {
@ -1149,7 +1149,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2023-03-02T11:38:35+00:00"
+            "time": "2023-05-31T13:04:02+00:00"
        },
        {
            "name": "symfony/polyfill-ctype",
@ -1571,16 +1571,16 @@
        },
        {
            "name": "nikic/php-parser",
-            "version": "v4.15.5",
+            "version": "v4.16.0",
            "source": {
                "type": "git",
                "url": "https://github.com/nikic/PHP-Parser.git",
-                "reference": "11e2663a5bc9db5d714eedb4277ee300403b4a9e"
+                "reference": "19526a33fb561ef417e822e85f08a00db4059c17"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/nikic/PHP-Parser/zipball/11e2663a5bc9db5d714eedb4277ee300403b4a9e",
-                "reference": "11e2663a5bc9db5d714eedb4277ee300403b4a9e",
+                "url": "https://api.github.com/repos/nikic/PHP-Parser/zipball/19526a33fb561ef417e822e85f08a00db4059c17",
+                "reference": "19526a33fb561ef417e822e85f08a00db4059c17",
                "shasum": ""
            },
            "require": {
@ -1621,9 +1621,9 @@
            ],
            "support": {
                "issues": "https://github.com/nikic/PHP-Parser/issues",
-                "source": "https://github.com/nikic/PHP-Parser/tree/v4.15.5"
+                "source": "https://github.com/nikic/PHP-Parser/tree/v4.16.0"
            },
-            "time": "2023-05-19T20:20:00+00:00"
+            "time": "2023-06-25T14:52:30+00:00"
        },
        {
            "name": "phar-io/manifest",
@ -2221,16 +2221,16 @@
        },
        {
            "name": "phpunit/phpunit",
-            "version": "10.1.3",
+            "version": "10.2.3",
            "source": {
                "type": "git",
                "url": "https://github.com/sebastianbergmann/phpunit.git",
-                "reference": "2379ebafc1737e71cdc84f402acb6b7f04198b9d"
+                "reference": "35c8cac1734ede2ae354a6644f7088356ff5b08e"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/sebastianbergmann/phpunit/zipball/2379ebafc1737e71cdc84f402acb6b7f04198b9d",
-                "reference": "2379ebafc1737e71cdc84f402acb6b7f04198b9d",
+                "url": "https://api.github.com/repos/sebastianbergmann/phpunit/zipball/35c8cac1734ede2ae354a6644f7088356ff5b08e",
+                "reference": "35c8cac1734ede2ae354a6644f7088356ff5b08e",
                "shasum": ""
            },
            "require": {
@ -2270,7 +2270,7 @@
            "type": "library",
            "extra": {
                "branch-alias": {
-                    "dev-main": "10.1-dev"
+                    "dev-main": "10.2-dev"
                }
            },
            "autoload": {
@ -2302,7 +2302,7 @@
            "support": {
                "issues": "https://github.com/sebastianbergmann/phpunit/issues",
                "security": "https://github.com/sebastianbergmann/phpunit/security/policy",
-                "source": "https://github.com/sebastianbergmann/phpunit/tree/10.1.3"
+                "source": "https://github.com/sebastianbergmann/phpunit/tree/10.2.3"
            },
            "funding": [
                {
@ -2318,7 +2318,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2023-05-11T05:16:22+00:00"
+            "time": "2023-06-30T06:17:38+00:00"
        },
        {
            "name": "sebastian/cli-parser",
--- a/src/Server.php
+++ b/src/Server.php
@ -1054,6 +1054,11 @@ class Server{

 			$this->logger->info($this->getLanguage()->translate(KnownTranslationFactory::pocketmine_server_defaultGameMode($this->getGamemode()->getTranslatableName())));
 			$this->logger->info($this->getLanguage()->translate(KnownTranslationFactory::pocketmine_server_donate(TextFormat::AQUA . "https://patreon.com/pocketminemp" . TextFormat::RESET)));
+
+			$this->logger->alert($this->getLanguage()->translate(KnownTranslationFactory::pocketmine_server_obsolete_warning1("4.x", "5.0")));
+			$this->logger->alert($this->getLanguage()->translate(KnownTranslationFactory::pocketmine_server_obsolete_warning2("4.x", "2023-09-01")));
+			$this->logger->alert($this->getLanguage()->translate(KnownTranslationFactory::pocketmine_server_obsolete_warning3("https://github.com/pmmp/PocketMine-MP/issues/5784")));
+
 			$this->logger->info($this->getLanguage()->translate(KnownTranslationFactory::pocketmine_server_startFinished(strval(round(microtime(true) - $this->startTime, 3)))));

 			$forwarder = new BroadcastLoggerForwarder($this, $this->logger, $this->language);
--- a/src/VersionInfo.php
+++ b/src/VersionInfo.php
@ -31,7 +31,7 @@ use function str_repeat;

 final class VersionInfo{
 	public const NAME = "PocketMine-MP";
-	public const BASE_VERSION = "4.22.1";
+	public const BASE_VERSION = "4.23.1";
 	public const IS_DEVELOPMENT_BUILD = false;
 	public const BUILD_CHANNEL = "stable";

--- a/src/network/mcpe/JwtUtils.php
+++ b/src/network/mcpe/JwtUtils.php
@ -61,6 +61,7 @@ use const OPENSSL_ALGO_SHA384;
 use const STR_PAD_LEFT;

 final class JwtUtils{
+	public const BEDROCK_SIGNING_KEY_CURVE_NAME = "secp384r1";

 	/**
 	 * @return string[]
@ -203,6 +204,17 @@ final class JwtUtils{
 		if($signingKeyOpenSSL === false){
 			throw new JwtException("OpenSSL failed to parse key: " . openssl_error_string());
 		}
+		$details = openssl_pkey_get_details($signingKeyOpenSSL);
+		if($details === false){
+			throw new JwtException("OpenSSL failed to get details from key: " . openssl_error_string());
+		}
+		if(!isset($details['ec']['curve_name'])){
+			throw new JwtException("Expected an EC key");
+		}
+		$curve = $details['ec']['curve_name'];
+		if($curve !== self::BEDROCK_SIGNING_KEY_CURVE_NAME){
+			throw new JwtException("Key must belong to curve " . self::BEDROCK_SIGNING_KEY_CURVE_NAME . ", got $curve");
+		}
 		return $signingKeyOpenSSL;
 	}
 }
--- a/src/network/mcpe/NetworkSession.php
+++ b/src/network/mcpe/NetworkSession.php
@ -84,6 +84,7 @@ use pocketmine\network\mcpe\protocol\types\AbilitiesLayer;
 use pocketmine\network\mcpe\protocol\types\BlockPosition;
 use pocketmine\network\mcpe\protocol\types\command\CommandData;
 use pocketmine\network\mcpe\protocol\types\command\CommandEnum;
+use pocketmine\network\mcpe\protocol\types\command\CommandOverload;
 use pocketmine\network\mcpe\protocol\types\command\CommandParameter;
 use pocketmine\network\mcpe\protocol\types\command\CommandPermissions;
 use pocketmine\network\mcpe\protocol\types\DimensionIds;
@ -949,8 +950,9 @@ class NetworkSession{
 				0,
 				$aliasObj,
 				[
-					[CommandParameter::standard("args", AvailableCommandsPacket::ARG_TYPE_RAWTEXT, 0, true)]
-				]
+					new CommandOverload(chaining: false, parameters: [CommandParameter::standard("args", AvailableCommandsPacket::ARG_TYPE_RAWTEXT, 0, true)])
+				],
+				chainedSubCommandData: []
 			);

 			$commandData[$command->getLabel()] = $data;
--- a/src/network/mcpe/auth/ProcessLoginTask.php
+++ b/src/network/mcpe/auth/ProcessLoginTask.php
@ -32,15 +32,26 @@ use pocketmine\scheduler\AsyncTask;
 use function base64_decode;
 use function igbinary_serialize;
 use function igbinary_unserialize;
-use function openssl_error_string;
 use function time;

 class ProcessLoginTask extends AsyncTask{
 	private const TLS_KEY_ON_COMPLETION = "completion";

+	/**
+	 * Old Mojang root auth key. This was used since the introduction of Xbox Live authentication in 0.15.0.
+	 * This key is expected to be replaced by the key below in the future, but this has not yet happened as of
+	 * 2023-07-01.
+	 * Ideally we would place a time expiry on this key, but since Mojang have not given a hard date for the key change,
+	 * and one bad guess has already caused a major outage, we can't do this.
+	 * TODO: This needs to be removed as soon as the new key is deployed by Mojang's authentication servers.
+	 */
 	public const MOJANG_OLD_ROOT_PUBLIC_KEY = "MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE8ELkixyLcwlZryUQcu1TvPOmI2B7vX83ndnWRUaXm74wFfa5f/lwQNTfrLVHa2PmenpGI6JhIMUJaWZrjmMj90NoKNFSNBuKdm8rYiXsfaz3K36x/1U26HpG0ZxK/V1V";
-	public const MOJANG_OLD_KEY_EXPIRY = 1688169600; //2023-07-01 00:00:00 UTC - there is no official date for the changeover to the new key, so this is a guess

+	/**
+	 * New Mojang root auth key. Mojang notified third-party developers of this change prior to the release of 1.20.0.
+	 * Expectations were that this would be used starting a "couple of weeks" after the release, but as of 2023-07-01,
+	 * it has not yet been deployed.
+	 */
 	public const MOJANG_ROOT_PUBLIC_KEY = "MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAECRXueJeTDqNRRgJi/vlRufByu/2G0i2Ebt6YMar5QX/R0DIIyrJMcUpruK4QveTfJSTp3Shlq4Gk34cD/4GUWwkv0DVuzeuB+tXija7HBxii03NHDbPAD0AKnLr2wdAp";

 	private const CLOCK_DRIFT_MAX = 60;
@ -144,7 +155,8 @@ class ProcessLoginTask extends AsyncTask{
 		try{
 			$signingKeyOpenSSL = JwtUtils::parseDerPublicKey($headerDerKey);
 		}catch(JwtException $e){
-			throw new VerifyLoginException("Invalid JWT public key: " . openssl_error_string());
+			//TODO: we shouldn't be showing this internal information to the client
+			throw new VerifyLoginException("Invalid JWT public key: " . $e->getMessage(), 0, $e);
 		}
 		try{
 			if(!JwtUtils::verify($jwt, $signingKeyOpenSSL)){
@ -154,7 +166,7 @@ class ProcessLoginTask extends AsyncTask{
 			throw new VerifyLoginException($e->getMessage(), 0, $e);
 		}

-		if($headers->x5u === self::MOJANG_ROOT_PUBLIC_KEY || (time() < self::MOJANG_OLD_KEY_EXPIRY && $headers->x5u === self::MOJANG_OLD_ROOT_PUBLIC_KEY)){
+		if($headers->x5u === self::MOJANG_ROOT_PUBLIC_KEY || $headers->x5u === self::MOJANG_OLD_ROOT_PUBLIC_KEY){
 			$this->authenticated = true; //we're signed into xbox live
 		}

@ -184,6 +196,12 @@ class ProcessLoginTask extends AsyncTask{
 			if($identityPublicKey === false){
 				throw new VerifyLoginException("Invalid identityPublicKey: base64 error decoding");
 			}
+			try{
+				//verify key format and parameters
+				JwtUtils::parseDerPublicKey($identityPublicKey);
+			}catch(JwtException $e){
+				throw new VerifyLoginException("Invalid identityPublicKey: " . $e->getMessage(), 0, $e);
+			}
 			$currentPublicKey = $identityPublicKey; //if there are further links, the next link should be signed with this
 		}
 	}
--- a/src/network/mcpe/encryption/EncryptionUtils.php
+++ b/src/network/mcpe/encryption/EncryptionUtils.php
@ -33,6 +33,7 @@ use function hex2bin;
 use function openssl_digest;
 use function openssl_error_string;
 use function openssl_pkey_derive;
+use function openssl_pkey_get_details;
 use function str_pad;
 use const STR_PAD_LEFT;

@ -42,7 +43,20 @@ final class EncryptionUtils{
 		//NOOP
 	}

+	private static function validateKey(\OpenSSLAsymmetricKey $key) : void{
+		$keyDetails = Utils::assumeNotFalse(openssl_pkey_get_details($key));
+		if(!isset($keyDetails["ec"]["curve_name"])){
+			throw new \InvalidArgumentException("Key must be an EC key");
+		}
+		$curveName = $keyDetails["ec"]["curve_name"];
+		if($curveName !== JwtUtils::BEDROCK_SIGNING_KEY_CURVE_NAME){
+			throw new \InvalidArgumentException("Key must belong to the " . JwtUtils::BEDROCK_SIGNING_KEY_CURVE_NAME . " elliptic curve, got $curveName");
+		}
+	}
+
 	public static function generateSharedSecret(\OpenSSLAsymmetricKey $localPriv, \OpenSSLAsymmetricKey $remotePub) : \GMP{
+		self::validateKey($localPriv);
+		self::validateKey($remotePub);
 		$hexSecret = openssl_pkey_derive($remotePub, $localPriv, 48);
 		if($hexSecret === false){
 			throw new \InvalidArgumentException("Failed to derive shared secret: " . openssl_error_string());
--- a/src/network/mcpe/handler/InGamePacketHandler.php
+++ b/src/network/mcpe/handler/InGamePacketHandler.php
@ -113,9 +113,9 @@ use pocketmine\utils\TextFormat;
 use pocketmine\utils\Utils;
 use pocketmine\world\format\Chunk;
 use function array_push;
-use function base64_encode;
 use function count;
 use function fmod;
+use function get_debug_type;
 use function implode;
 use function in_array;
 use function is_bool;
@ -748,27 +748,32 @@ class InGamePacketHandler extends PacketHandler{
 		if(!($nbt instanceof CompoundTag)) throw new AssumptionFailedError("PHPStan should ensure this is a CompoundTag"); //for phpstorm's benefit

 		if($block instanceof BaseSign){
-			if(($textBlobTag = $nbt->getCompoundTag(Sign::TAG_FRONT_TEXT)?->getTag(Sign::TAG_TEXT_BLOB)) instanceof StringTag){
-				try{
-					$text = SignText::fromBlob($textBlobTag->getValue());
-				}catch(\InvalidArgumentException $e){
-					throw PacketHandlingException::wrap($e, "Invalid sign text update");
-				}
-
-				try{
-					if(!$block->updateText($this->player, $text)){
-						foreach($this->player->getWorld()->createBlockUpdatePackets([$pos]) as $updatePacket){
-							$this->session->sendDataPacket($updatePacket);
-						}
-					}
-				}catch(\UnexpectedValueException $e){
-					throw PacketHandlingException::wrap($e);
-				}
-
-				return true;
+			$frontTextTag = $nbt->getTag(Sign::TAG_FRONT_TEXT);
+			if(!$frontTextTag instanceof CompoundTag){
+				throw new PacketHandlingException("Invalid tag type " . get_debug_type($frontTextTag) . " for tag \"" . Sign::TAG_FRONT_TEXT . "\" in sign update data");
+			}
+			$textBlobTag = $frontTextTag->getTag(Sign::TAG_TEXT_BLOB);
+			if(!$textBlobTag instanceof StringTag){
+				throw new PacketHandlingException("Invalid tag type " . get_debug_type($textBlobTag) . " for tag \"" . Sign::TAG_TEXT_BLOB . "\" in sign update data");
 			}

-			$this->session->getLogger()->debug("Invalid sign update data: " . base64_encode($packet->nbt->getEncodedNbt()));
+			try{
+				$text = SignText::fromBlob($textBlobTag->getValue());
+			}catch(\InvalidArgumentException $e){
+				throw PacketHandlingException::wrap($e, "Invalid sign text update");
+			}
+
+			try{
+				if(!$block->updateText($this->player, $text)){
+					foreach($this->player->getWorld()->createBlockUpdatePackets([$pos]) as $updatePacket){
+						$this->session->sendDataPacket($updatePacket);
+					}
+				}
+			}catch(\UnexpectedValueException $e){
+				throw PacketHandlingException::wrap($e);
+			}
+
+			return true;
 		}

 		return false;
--- a/src/scheduler/AsyncTask.php
+++ b/src/scheduler/AsyncTask.php
@ -252,9 +252,15 @@ abstract class AsyncTask extends \Threaded{
 	final public function __destruct(){
 		$this->reallyDestruct();
 		if(self::$threadLocalStorage !== null && isset(self::$threadLocalStorage[$h = spl_object_id($this)])){
-			unset(self::$threadLocalStorage[$h]);
-			if(self::$threadLocalStorage->count() === 0){
+			//Beware changing this code!
+			//This code may cause the GC to be triggered, causing destruction of other AsyncTasks (which may or may not
+			//have been indirectly referenced by the TLS).
+			//This may cause the code to be re-entered from a different context unexpectedly, causing a crash if handled
+			//incorrectly.
+			if(self::$threadLocalStorage->count() === 1){
 				self::$threadLocalStorage = null;
+			}else{
+				unset(self::$threadLocalStorage[$h]);
 			}
 		}
 	}
--- a/tests/phpunit/scheduler/AsyncPoolTest.php
+++ b/tests/phpunit/scheduler/AsyncPoolTest.php
@ -69,4 +69,36 @@ class AsyncPoolTest extends TestCase{
 		}
 		self::assertTrue(PublishProgressRaceAsyncTask::$success, "Progress was not reported before task completion");
 	}
+
+	/**
+	 * This test ensures that the fix for an exotic AsyncTask::__destruct() reentrancy bug has not regressed.
+	 *
+	 * Due to an unset() in the function body, other AsyncTask::__destruct() calls could be triggered during
+	 * an AsyncTask's destruction. If done in the wrong way, this could lead to a crash.
+	 *
+	 * @doesNotPerformAssertions This test is checking for a crash condition, not a specific output.
+	 */
+	public function testTaskDestructorReentrancy() : void{
+		$this->pool->submitTask(new class extends AsyncTask{
+			public function __construct(){
+				$this->storeLocal("task", new class extends AsyncTask{
+
+					public function __construct(){
+						$this->storeLocal("dummy", 1);
+					}
+
+					public function onRun() : void{
+						//dummy
+					}
+				});
+			}
+
+			public function onRun() : void{
+				//dummy
+			}
+		});
+		while($this->pool->collectTasks()){
+			usleep(50 * 1000);
+		}
+	}
 }
Author	SHA1	Message	Date
Dylan K. Taylor	935df62006	Release 4.23.1	2023-07-14 13:06:26 +01:00
Dylan K. Taylor	2709dd359c	ProcessLoginTask: fixed backport errors	2023-07-14 12:37:50 +01:00
Dylan K. Taylor	4e646d19a4	Harden login EC key validation	2023-07-14 11:55:47 +01:00
Dylan K. Taylor	2a11762e61	Update JsonMapper dependency	2023-07-14 11:54:05 +01:00
Dylan K. Taylor	7e0b5cf73d	4.23.1 is next	2023-07-12 13:44:16 +01:00
Dylan K. Taylor	e903da8998	Release 4.23.0	2023-07-12 13:44:16 +01:00
Dylan K. Taylor	f2193d1ba7	1.20.10	2023-07-12 13:23:47 +01:00
Dylan K. Taylor	f7977c9668	Update build/php submodule to pmmp/PHP-Binaries@16378ffcc3	2023-07-12 12:10:09 +01:00
Dylan K. Taylor	cfd9950b02	4.22.4 is next	2023-07-11 16:01:42 +01:00
Dylan K. Taylor	8ebcdb452d	Release 4.22.3	2023-07-11 16:01:38 +01:00
Dylan K. Taylor	aacc00a911	update-updater-api: do not allow multiple jobs to run simultaneously this would result in git conflicts if multiple releases are made at the same time closes #5814	2023-07-11 15:10:35 +01:00
Dylan K. Taylor	0c250a2ef0	InGamePacketHandler: fixed inconsistent handling of invalid data in BlockActorDataPacket	2023-07-11 12:53:29 +01:00
Dylan K. Taylor	70dd9c7371	AsyncTask: fixed reentrancy bug tested by `f8e6f036af`	2023-07-01 13:27:32 +01:00
Dylan K. Taylor	f8e6f036af	AsyncPoolTest: added failing test case for AsyncTask::__destruct() reentrancy bug	2023-07-01 13:24:50 +01:00
Dylan K. Taylor	bbabccfc89	4.22.3 is next	2023-07-01 12:04:59 +01:00
Dylan K. Taylor	1698eac6dc	Release 4.22.2	2023-07-01 12:04:59 +01:00
Dylan K. Taylor	321972b87b	Composer: do not allow automatic minor dependency updates manual intervention should always be used here, since we need to present a consistent API to plugins.	2023-07-01 11:57:13 +01:00
Dylan K. Taylor	c86c9b3ead	Update Composer dependencies	2023-07-01 11:43:36 +01:00
Dylan K. Taylor	249ef9c534	ProcessLoginTask: remove old key expiry since we don't have a hard date for this, and I've already made one wrong educated guess, I'd rather not have another massive outage. A security update will have to be made to remove the old key as soon as the new one is rolled. This is not ideal, but it's the least disruptive option.	2023-07-01 11:41:04 +01:00
Dylan K. Taylor	f4dab17a1b	Added deprecation notices	2023-07-01 10:29:14 +01:00
Dylan K. Taylor	e85605af7f	changelog: fixed typo [ci skip]	2023-06-09 01:44:45 +01:00
Dylan K. Taylor	dfd70615ad	4.22.2 is next	2023-06-09 01:33:35 +01:00