Merge remote-tracking branch 'upstream/stable' into stable

.github/PULL_REQUEST_TEMPLATE.md

@@ -34,7 +34,10 @@ Requires translations:
 
 ## Tests
 <!--
-Details should be provided of tests done. Simply saying "tested" or equivalent is not acceptable.
-
-Attach scripts or actions to test this pull request, as well as the result
+PRs which have not been tested MUST be marked as draft.
 -->
+I tested this PR by doing the following (tick all that apply):
+- [ ] Writing PHPUnit tests (commit these in the `tests/phpunit` folder)
+- [ ] Playtesting using a Minecraft client (provide screenshots or a video)
+- [ ] Writing a test plugin (provide the code and sample output)
+- [ ] Other (provide details)

.github/workflows/draft-release.yml

@@ -86,7 +86,7 @@ jobs:
             ${{ github.workspace }}/build_info.json
 
       - name: Create draft release
-        uses: ncipollo/release-action@v1.13.0
+        uses: ncipollo/release-action@v1.14.0
         with:
           artifacts: ${{ github.workspace }}/PocketMine-MP.phar,${{ github.workspace }}/start.*,${{ github.workspace }}/build_info.json
           commit: ${{ github.sha }}

.github/workflows/main-php-matrix.yml

@@ -30,7 +30,7 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Setup PHP
-        uses: pmmp/setup-php-action@2.0.0
+        uses: pmmp/setup-php-action@3.0.0
         with:
           php-version: ${{ inputs.php }}
           install-path: "./bin"
@@ -62,7 +62,7 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Setup PHP
-        uses: pmmp/setup-php-action@2.0.0
+        uses: pmmp/setup-php-action@3.0.0
         with:
           php-version: ${{ inputs.php }}
           install-path: "./bin"
@@ -96,7 +96,7 @@ jobs:
           submodules: true
 
       - name: Setup PHP
-        uses: pmmp/setup-php-action@2.0.0
+        uses: pmmp/setup-php-action@3.0.0
         with:
           php-version: ${{ inputs.php }}
           install-path: "./bin"
@@ -128,7 +128,7 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Setup PHP
-        uses: pmmp/setup-php-action@2.0.0
+        uses: pmmp/setup-php-action@3.0.0
         with:
           php-version: ${{ inputs.php }}
           install-path: "./bin"

changelogs/5.11.md

@@ -24,3 +24,16 @@ Consider using the `mcpe-protocol` directive in `plugin.yml` as a constraint if
 - Restructured GitHub Actions CI workflows to make them easier to maintain (no need to update PHP versions in multiple places anymore).
 - GitHub Actions CodeStyle workflow now uses php-cs-fixer 3.49.x.
 - Dependabot updates are now processed weekly instead of daily.
+
+# 5.11.1
+Released 23rd February 2024.
+
+## Fixes
+- Fixed subchunk count calculation in `ChunkSerializer` for non-overworld dimension (useful for dimension plugins).
+- Harden options used for processing JSON data, particularly on the network, to close security issues.
+
+## Documentation
+- Fixed PHPStan signature for `Utils::cloneObjectArray()`.
+
+## Internals
+- Updated GitHub Actions versions to get rid of deprecation warnings.

composer.json

@@ -32,7 +32,7 @@
       "ext-zlib": ">=1.2.11",
       "composer-runtime-api": "^2.0",
       "adhocore/json-comment": "~1.2.0",
-      "pocketmine/netresearch-jsonmapper": "~v4.2.1000",
+      "pocketmine/netresearch-jsonmapper": "~v4.4.999",
       "pocketmine/bedrock-block-upgrade-schema": "~3.5.0+bedrock-1.20.60",
       "nethergamesmc/bedrock-data": "dev-master",
       "pocketmine/bedrock-item-upgrade-schema": "~1.7.0+bedrock-1.20.60",
@@ -52,7 +52,7 @@
       "symfony/filesystem": "~6.4.0"
    },
    "require-dev": {
-      "phpstan/phpstan": "1.10.57",
+      "phpstan/phpstan": "1.10.58",
       "phpstan/phpstan-phpunit": "^1.1.0",
       "phpstan/phpstan-strict-rules": "^1.2.0",
       "phpunit/phpunit": "~10.3.0 || ~10.2.0 || ~10.1.0"

src/VersionInfo.php

@@ -31,7 +31,7 @@
 
 final class VersionInfo{
 	public const NAME = "PocketMine-MP";
-	public const BASE_VERSION = "5.11.1";
+	public const BASE_VERSION = "5.11.2";
 	public const IS_DEVELOPMENT_BUILD = true;
 	public const BUILD_CHANNEL = "stable";
 

src/data/bedrock/block/upgrade/BlockStateUpgradeSchemaUtils.php

@@ -389,6 +389,9 @@ public static function loadSchemaFromString(string $raw, int $schemaId) : BlockS
 		}
 
 		$jsonMapper = new \JsonMapper();
+		$jsonMapper->bExceptionOnMissingData = true;
+		$jsonMapper->bExceptionOnUndefinedProperty = true;
+		$jsonMapper->bStrictObjectTypeChecking = true;
 		try{
 			$model = $jsonMapper->map($json, new BlockStateUpgradeSchemaModel());
 		}catch(\JsonMapper_Exception $e){

src/data/bedrock/item/upgrade/ItemIdMetaUpgradeSchemaUtils.php

@@ -88,6 +88,9 @@ public static function loadSchemaFromString(string $raw, int $schemaId) : ItemId
 		}
 
 		$jsonMapper = new \JsonMapper();
+		$jsonMapper->bExceptionOnMissingData = true;
+		$jsonMapper->bExceptionOnUndefinedProperty = true;
+		$jsonMapper->bStrictObjectTypeChecking = true;
 		try{
 			$model = $jsonMapper->map($json, new ItemIdMetaUpgradeSchemaModel());
 		}catch(\JsonMapper_Exception $e){

src/network/mcpe/auth/ProcessLoginTask.php

@@ -135,6 +135,7 @@ private function validateToken(string $jwt, ?string &$currentPublicKey, bool $fi
 		$mapper = new \JsonMapper();
 		$mapper->bExceptionOnMissingData = true;
 		$mapper->bExceptionOnUndefinedProperty = true;
+		$mapper->bStrictObjectTypeChecking = true;
 		$mapper->bEnforceMapType = false;
 
 		try{
@@ -181,6 +182,7 @@ private function validateToken(string $jwt, ?string &$currentPublicKey, bool $fi
 		$mapper = new \JsonMapper();
 		$mapper->bExceptionOnUndefinedProperty = false; //we only care about the properties we're using in this case
 		$mapper->bExceptionOnMissingData = true;
+		$mapper->bStrictObjectTypeChecking = true;
 		$mapper->bEnforceMapType = false;
 		$mapper->bRemoveUndefinedAttributes = true;
 		try{

src/network/mcpe/handler/LoginPacketHandler.php

@@ -180,6 +180,7 @@ protected function fetchAuthData(JwtChain $chain) : AuthenticationData{
 				$mapper->bEnforceMapType = false; //TODO: we don't really need this as an array, but right now we don't have enough models
 				$mapper->bExceptionOnMissingData = true;
 				$mapper->bExceptionOnUndefinedProperty = true;
+				$mapper->bStrictObjectTypeChecking = true;
 				try{
 					/** @var AuthenticationData $extraData */
 					$extraData = $mapper->map($claims["extraData"], new AuthenticationData());
@@ -208,6 +209,7 @@ protected function parseClientData(string $clientDataJwt) : ClientData{
 		$mapper->bEnforceMapType = false; //TODO: we don't really need this as an array, but right now we don't have enough models
 		$mapper->bExceptionOnMissingData = true;
 		$mapper->bExceptionOnUndefinedProperty = true;
+		$mapper->bStrictObjectTypeChecking = true;
 		try{
 			$clientData = $mapper->map($clientDataClaims, new ClientData());
 		}catch(\JsonMapper_Exception $e){

src/resourcepacks/ZippedResourcePack.php

@@ -108,6 +108,7 @@ public function __construct(string $zipPath){
 
 		$mapper = new \JsonMapper();
 		$mapper->bExceptionOnMissingData = true;
+		$mapper->bStrictObjectTypeChecking = true;
 
 		try{
 			/** @var Manifest $manifest */

src/updater/UpdateCheckTask.php

@@ -55,6 +55,7 @@ public function onRun() : void{
 				}else{
 					$mapper = new \JsonMapper();
 					$mapper->bExceptionOnMissingData = true;
+					$mapper->bStrictObjectTypeChecking = true;
 					$mapper->bEnforceMapType = false;
 					try{
 						/** @var UpdateInfo $responseObj */

src/utils/Utils.php

@@ -174,16 +174,17 @@ public static function cloneCallback() : \Closure{
 	}
 
 	/**
-	 * @phpstan-template T of object
+	 * @phpstan-template TKey of array-key
+	 * @phpstan-template TValue of object
 	 *
 	 * @param object[] $array
-	 * @phpstan-param T[] $array
+	 * @phpstan-param array<TKey, TValue> $array
 	 *
 	 * @return object[]
-	 * @phpstan-return T[]
+	 * @phpstan-return array<TKey, TValue>
 	 */
 	public static function cloneObjectArray(array $array) : array{
-		/** @phpstan-var \Closure(T) : T $callback */
+		/** @phpstan-var \Closure(TValue) : TValue $callback */
 		$callback = self::cloneCallback();
 		return array_map($callback, $array);
 	}