Validate tab completion requests before exposing command suggestions (#113)

* validate the requested command before exposing argument completions

* fix waterfall tab completion filtering

* some formatting

basic idea formatting wont be bad

CommandWhitelistBukkit/src/main/java/eu/endermite/commandwhitelist/bukkit/CommandWhitelistBukkit.java

@@ -20,7 +20,10 @@ import org.bukkit.plugin.Plugin;
 import org.bukkit.plugin.java.JavaPlugin;
 
 import java.io.File;
-import java.util.*;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.Map;
 import java.util.concurrent.CompletableFuture;
 
 public class CommandWhitelistBukkit extends JavaPlugin {
@@ -85,7 +88,8 @@ public class CommandWhitelistBukkit extends JavaPlugin {
                 for (Player p : Bukkit.getOnlinePlayers()) {
                     p.updateCommands();
                 }
-            } catch (Exception ignored) {}
+            } catch (Exception ignored) {
+            }
             audiences.sender(sender).sendMessage(CWCommand.miniMessage.deserialize(configCache.prefix + configCache.config_reloaded));
         });
     }

CommandWhitelistBukkit/src/main/java/eu/endermite/commandwhitelist/bukkit/listeners/AsyncTabCompleteBlockerListener.java

@@ -13,11 +13,12 @@ public class AsyncTabCompleteBlockerListener implements Listener {
 
     @EventHandler(priority = EventPriority.HIGHEST)
     public void onCommandTabComplete(AsyncTabCompleteEvent event) {
-        if (!(event.getSender() instanceof Player)) return;
+        if (!(event.getSender() instanceof Player player)) return;
-        Player player = (Player) event.getSender();
         if (player.hasPermission(CWPermission.BYPASS.permission())) return;
         String buffer = event.getBuffer();
-        if ((buffer.split(" ").length == 1 && !buffer.endsWith(" ")) || !buffer.startsWith("/")) {
+        int commandEnd = buffer.indexOf(' ');
+        if (commandEnd < 0 || buffer.charAt(0) != '/' || !CommandWhitelistBukkit.getCommands(player)
+                .contains(buffer.substring(1, commandEnd).toLowerCase())) {
             CommandWhitelistBukkit.getConfigCache().debug("Actively prevented " + event.getSender().getName() + "'s tab completion (sus packet)");
             event.setCancelled(true);
             return;

CommandWhitelistBukkit/src/main/java/eu/endermite/commandwhitelist/bukkit/listeners/TabCompleteBlockerListener.java

@@ -13,11 +13,12 @@ public class TabCompleteBlockerListener implements Listener {
 
     @EventHandler(priority = EventPriority.NORMAL)
     public void onCommandTabComplete(TabCompleteEvent event) {
-        if (!(event.getSender() instanceof Player)) return;
+        if (!(event.getSender() instanceof Player player)) return;
-        Player player = (Player) event.getSender();
         if (player.hasPermission(CWPermission.BYPASS.permission())) return;
         String buffer = event.getBuffer();
-        if ((buffer.split(" ").length == 1 && !buffer.endsWith(" ")) || !buffer.startsWith("/")) {
+        int commandEnd = buffer.indexOf(' ');
+        if (commandEnd < 0 || buffer.charAt(0) != '/' || !CommandWhitelistBukkit.getCommands(player)
+                .contains(buffer.substring(1, commandEnd).toLowerCase())) {
             CommandWhitelistBukkit.getConfigCache().debug("Actively prevented " + event.getSender().getName() + "'s tab completion (sus packet)");
             event.setCancelled(true);
             return;

CommandWhitelistWaterfall/src/main/java/eu/endermite/commandwhitelist/waterfall/listeners/BungeeTabcompleteListener.java

@@ -7,19 +7,35 @@ import net.md_5.bungee.api.connection.ProxiedPlayer;
 import net.md_5.bungee.api.plugin.Listener;
 import net.md_5.bungee.event.EventHandler;
 
+import java.util.List;
+
 public class BungeeTabcompleteListener implements Listener {
 
     @EventHandler
     public void onTabcomplete(net.md_5.bungee.api.event.TabCompleteEvent event) {
-        if (!(event.getReceiver() instanceof ProxiedPlayer)) return;
+        if (!(event.getSender() instanceof ProxiedPlayer)) return;
-        ProxiedPlayer player = (ProxiedPlayer) event.getReceiver();
+        ProxiedPlayer player = (ProxiedPlayer) event.getSender();
-        if (event.getSuggestions().isEmpty()) return;
         if (player.hasPermission(CWPermission.BYPASS.permission())) return;
-        CommandUtil.filterSuggestions(
+
+        String cursor = event.getCursor();
+        int commandEnd = cursor.indexOf(' ');
+        if (commandEnd >= 0 && cursor.charAt(0) == '/') {
+            String command = cursor.substring(1, commandEnd).toLowerCase();
+            if (CommandWhitelistWaterfall.getPlugin().getProxy().getPluginManager().isExecutableCommand(command, player)
+                    && !CommandWhitelistWaterfall.getCommands(player).contains(command)) {
+                event.setCancelled(true);
+                return;
+            }
+        }
+        if (event.getSuggestions().isEmpty()) return;
+
+        List<String> suggestions = CommandUtil.filterSuggestions(
                 event.getCursor(),
                 event.getSuggestions(),
                 CommandWhitelistWaterfall.getSuggestions(player)
         );
+        event.getSuggestions().clear();
+        event.getSuggestions().addAll(suggestions);
     }
 
 }