Skip to content

Commit a29dee6

Browse files
cev-apicev-api
committed
Merge remote-tracking branch 'upstream/1.21.8' into 1.21.8
2 parents cf7ff54 + 25c1bfb commit a29dee6

6 files changed

Lines changed: 68 additions & 17 deletions

File tree

‎build.gradle‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -29,16 +29,18 @@ repositories {
2929
// Override vulnerable dependencies until Minecraft updates to newer versions
3030
configurations.all {
3131
resolutionStrategy {
32-
// v2.5.1, used by Minecraft 1.21.4 - 1.21.8, is vulnerable to CVE-2024-57699
32+
// v2.5.1, used by Minecraft 1.21.4 - 1.21.10, is vulnerable to CVE-2024-57699
3333
force "net.minidev:json-smart:2.5.2"
34-
// v2.13.4, used by Minecraft 1.21.4 - 1.21.8, is vulnerable to CVE-2025-52999
34+
// v2.13.4, used by Minecraft 1.21.4 - 1.21.10, is vulnerable to CVE-2025-52999
3535
force "com.fasterxml.jackson.core:jackson-core:2.15.0"
36-
// v3.17.0, used by Minecraft 1.21.4 - 1.21.8, is vulnerable to CVE-2025-48924
36+
// v3.17.0, used by Minecraft 1.21.4 - 1.21.10, is vulnerable to CVE-2025-48924
3737
force "org.apache.commons:commons-lang3:3.18.0"
38-
// v9.40, used by Minecraft 1.21.4 - 1.21.8, is vulnerable to CVE-2025-53864
38+
// v9.40, used by Minecraft 1.21.4 - 1.21.10, is vulnerable to CVE-2025-53864
3939
force "com.nimbusds:nimbus-jose-jwt:10.0.2"
40-
// v4.1.118.Final, used by Minecraft 1.21.5 - 1.21.8, is vulnerable to CVE-2025-58057
40+
// v4.1.118.Final, used by Minecraft 1.21.5 - 1.21.10, is vulnerable to CVE-2025-58057
4141
force "io.netty:netty-codec:4.1.125.Final"
42+
// v4.1.118.Final, used by Minecraft 1.21.5 - 1.21.10, is vulnerable to CVE-2025-58056
43+
force "io.netty:netty-codec-http:4.1.125.Final"
4244
}
4345
}
4446

‎gradle.properties‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,14 +8,14 @@ org.gradle.configuration-cache=true
88
# https://modrinth.com/mod/fabric-api/versions
99
minecraft_version=1.21.8
1010
yarn_mappings=1.21.8+build.1
11-
loader_version=0.17.2
11+
loader_version=0.17.3
1212
loom_version=1.11-SNAPSHOT
1313

1414
# Fabric API
15-
fabric_version=0.133.4+1.21.8
15+
fabric_version=0.134.0+1.21.8
1616

1717
# Mod Properties
18-
mod_version=v7.50.2-MC1.21.8
18+
mod_version=v7.50.3-MC1.21.8
1919
maven_group=net.wurstclient
2020
archives_base_name=Wurst-Client
2121
mod_loader=Fabric

‎src/main/java/net/wurstclient/WurstClient.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ public enum WurstClient
5050
public static MinecraftClient MC;
5151
public static IMinecraftClient IMC;
5252

53-
public static final String VERSION = "7.50.2";
53+
public static final String VERSION = "7.50.3";
5454
public static final String MC_VERSION = "1.21.8";
5555

5656
private PlausibleAnalytics plausible;

‎src/main/java/net/wurstclient/mixin/DownloaderMixin.java‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515
import org.spongepowered.asm.mixin.Shadow;
1616
import org.spongepowered.asm.mixin.injection.At;
1717

18+
<<<<<<< HEAD
1819
import com.llamalad7.mixinextras.injector.ModifyExpressionValue;
1920
import com.llamalad7.mixinextras.sugar.Local;
2021

@@ -23,11 +24,24 @@
2324

2425
@Mixin(Downloader.class)
2526
public abstract class DownloaderMixin
27+
=======
28+
import com.llamalad7.mixinextras.injector.wrapoperation.Operation;
29+
import com.llamalad7.mixinextras.injector.wrapoperation.WrapOperation;
30+
31+
import net.minecraft.client.session.Session;
32+
import net.minecraft.util.Downloader;
33+
import net.minecraft.util.Uuids;
34+
import net.wurstclient.WurstClient;
35+
36+
@Mixin(Downloader.class)
37+
public abstract class DownloaderMixin implements AutoCloseable
38+
>>>>>>> upstream/1.21.8
2639
{
2740
@Shadow
2841
@Final
2942
private Path directory;
3043

44+
<<<<<<< HEAD
3145
@ModifyExpressionValue(method = "method_55485",
3246
at = @At(value = "INVOKE",
3347
target = "Ljava/nio/file/Path;resolve(Ljava/lang/String;)Ljava/nio/file/Path;"))
@@ -36,5 +50,41 @@ public abstract class DownloaderMixin
3650
{
3751
return ResourcePackProtector.remapDownloadPath(directory, original,
3852
packId);
53+
=======
54+
/**
55+
* Patches a fingerprinting vulnerability by creating a separate cache
56+
* folder for each Minecraft account.
57+
*
58+
* <p>
59+
* This mixin targets the <code>entries.forEach()</code> lambda in
60+
* <code>download(Config, Map)</code>.
61+
*
62+
* @see https://github.com/Wurst-Imperium/Wurst7/issues/1226
63+
*/
64+
@WrapOperation(at = @At(value = "INVOKE",
65+
target = "Ljava/nio/file/Path;resolve(Ljava/lang/String;)Ljava/nio/file/Path;",
66+
ordinal = 0,
67+
remap = false), method = "method_55485")
68+
private Path wrapResolve(Path instance, String filename,
69+
Operation<Path> original)
70+
{
71+
Path result = original.call(instance, filename);
72+
73+
// If the path has already been modified by another mod (likely trying
74+
// to patch the same exploit), don't modify it further.
75+
if(result == null || !result.getParent().equals(directory))
76+
return result;
77+
78+
// "getUuidOrNull" seems to be an outdated Yarn name, as Minecraft
79+
// 1.21.10 treats this like a non-null method. Just in case, we manually
80+
// fallback to the offline UUID if it ever does return null.
81+
Session session = WurstClient.MC.getSession();
82+
UUID uuid = session.getUuidOrNull();
83+
if(uuid == null)
84+
uuid = Uuids.getOfflinePlayerUuid(session.getUsername());
85+
86+
return result.getParent().resolve(uuid.toString())
87+
.resolve(result.getFileName());
88+
>>>>>>> upstream/1.21.8
3989
}
4090
}

‎src/main/java/net/wurstclient/mixin/GameRendererMixin.java‎

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -15,10 +15,10 @@
1515
import org.spongepowered.asm.mixin.injection.callback.CallbackInfo;
1616
import org.spongepowered.asm.mixin.injection.callback.CallbackInfoReturnable;
1717

18+
import com.llamalad7.mixinextras.injector.ModifyReturnValue;
1819
import com.llamalad7.mixinextras.injector.wrapoperation.Operation;
1920
import com.llamalad7.mixinextras.injector.wrapoperation.WrapOperation;
2021

21-
import net.minecraft.client.render.Camera;
2222
import net.minecraft.client.render.GameRenderer;
2323
import net.minecraft.client.render.RenderTickCounter;
2424
import net.minecraft.client.util.math.MatrixStack;
@@ -84,14 +84,12 @@ private void onRenderHand(float tickDelta, boolean bl, Matrix4f matrix4f,
8484
cancelNextBobView = false;
8585
}
8686

87-
@Inject(at = @At(value = "RETURN", ordinal = 1),
88-
method = "getFov(Lnet/minecraft/client/render/Camera;FZ)F",
89-
cancellable = true)
90-
private void onGetFov(Camera camera, float tickDelta, boolean changingFov,
91-
CallbackInfoReturnable<Float> cir)
87+
@ModifyReturnValue(at = @At("RETURN"),
88+
method = "getFov(Lnet/minecraft/client/render/Camera;FZ)F")
89+
private float onGetFov(float original)
9290
{
93-
cir.setReturnValue(WurstClient.INSTANCE.getOtfs().zoomOtf
94-
.changeFovBasedOnZoom(cir.getReturnValueF()));
91+
return WurstClient.INSTANCE.getOtfs().zoomOtf
92+
.changeFovBasedOnZoom(original);
9593
}
9694

9795
/**

‎src/main/resources/wurst.mixins.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@
3232
"DirectConnectScreenMixin",
3333
"DownloaderMixin",
3434
"DisconnectedScreenMixin",
35+
"DownloaderMixin",
3536
"EntityMixin",
3637
"EntityRenderDispatcherMixin",
3738
"EntityRendererMixin",

0 commit comments

Comments
 (0)