From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Zach Brown <zach.brown@destroystokyo.com>
Date: Sat, 12 Nov 2016 23:25:22 -0600
Subject: [PATCH] Filter bad data from ArmorStand and SpawnEgg items


diff --git a/src/main/java/com/destroystokyo/paper/PaperWorldConfig.java b/src/main/java/com/destroystokyo/paper/PaperWorldConfig.java
index 97b02b5a4808fc0b7fd2d2a88817716cba61054b..fd64a7c1ee7617285990fd5066f768f0bcf2dbcf 100644
--- a/src/main/java/com/destroystokyo/paper/PaperWorldConfig.java
+++ b/src/main/java/com/destroystokyo/paper/PaperWorldConfig.java
@@ -352,4 +352,12 @@ public class PaperWorldConfig {
         preventTntFromMovingInWater = getBoolean("prevent-tnt-from-moving-in-water", false);
         log("Prevent TNT from moving in water: " + preventTntFromMovingInWater);
     }
+
+    public boolean filterNBTFromSpawnEgg = true;
+    private void fitlerNBTFromSpawnEgg() {
+        filterNBTFromSpawnEgg = getBoolean("filter-nbt-data-from-spawn-eggs-and-related", true);
+        if (!filterNBTFromSpawnEgg) {
+            Bukkit.getLogger().warning("Spawn Egg and Armor Stand NBT filtering disabled, this is a potential security risk");
+        }
+    }
 }
diff --git a/src/main/java/net/minecraft/world/entity/item/FallingBlockEntity.java b/src/main/java/net/minecraft/world/entity/item/FallingBlockEntity.java
index 242e02646b8584a8d2a512374ad03729661d584f..08defb76e73a5f9121bf405c86a3c4c750ab1933 100644
--- a/src/main/java/net/minecraft/world/entity/item/FallingBlockEntity.java
+++ b/src/main/java/net/minecraft/world/entity/item/FallingBlockEntity.java
@@ -316,6 +316,18 @@ public class FallingBlockEntity extends Entity {
     @Override
     protected void readAdditionalSaveData(CompoundTag nbt) {
         this.blockState = NbtUtils.readBlockState(nbt.getCompound("BlockState"));
+        // Paper start - Block FallingBlocks with Command Blocks
+        final Block b = this.blockState.getBlock();
+        if (this.level.paperConfig.filterNBTFromSpawnEgg
+            && (b == Blocks.COMMAND_BLOCK
+            || b == Blocks.REPEATING_COMMAND_BLOCK
+            || b == Blocks.CHAIN_COMMAND_BLOCK
+            || b == Blocks.JIGSAW
+            || b == Blocks.STRUCTURE_BLOCK
+            || b instanceof net.minecraft.world.level.block.GameMasterBlock)) {
+            this.blockState = Blocks.STONE.defaultBlockState();
+        }
+        // Paper end
         this.time = nbt.getInt("Time");
         if (nbt.contains("HurtEntities", 99)) {
             this.hurtEntities = nbt.getBoolean("HurtEntities");