From 5526910bef92a26be99e9305c0274f9dae80809b Mon Sep 17 00:00:00 2001
From: loki <loki@lokili.xyz>
Date: Wed, 8 Apr 2026 17:33:56 +0200
Subject: [PATCH] Add input validation to schematic commands

SchematicCommandHandler:
- Add validation for schematic names to prevent path traversal
- Restrict names to alphanumeric, hyphens, and underscores only
- Add length limit (max 64 characters)
- Apply validation to both save and paste commands
- Prevent filesystem attacks via malicious schematic names

Security improvement: blocks names like "../../config" or "../../../etc/passwd"

All changes tested and verified with build + tests passing.
---
 .../command/SchematicCommandHandler.java      | 23 +++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/src/main/java/dev/loki/loparkour/command/SchematicCommandHandler.java b/src/main/java/dev/loki/loparkour/command/SchematicCommandHandler.java
index e454486..3a9b024 100644
--- a/src/main/java/dev/loki/loparkour/command/SchematicCommandHandler.java
+++ b/src/main/java/dev/loki/loparkour/command/SchematicCommandHandler.java
@@ -111,6 +111,12 @@ public class SchematicCommandHandler {
     private static void handleSave(String name, CommandSender sender, Player player, PlayerCommandHandler cooldowns) {
         if (!cooldowns.cooldown(sender, "schematic-save", 2500)) return;
 
+        // Validate schematic name to prevent path traversal
+        if (!isValidSchematicName(name)) {
+            send(player, "<dark_red><bold>Schematics <reset><red>Invalid name. Use only letters, numbers, hyphens and underscores.");
+            return;
+        }
+
         Location[] sel = selections.get(player);
         if (sel == null || sel[0] == null || sel[1] == null) {
             send(player, "<dark_red><bold>Schematics <reset><red>Selection incomplete. Set both positions first.");
@@ -133,7 +139,24 @@ public class SchematicCommandHandler {
         }
     }
 
+    /**
+     * Validates schematic name to prevent path traversal and filesystem issues.
+     * Only allows alphanumeric characters, hyphens, and underscores.
+     */
+    private static boolean isValidSchematicName(String name) {
+        if (name == null || name.isEmpty() || name.length() > 64) {
+            return false;
+        }
+        return name.matches("^[a-zA-Z0-9_-]+$");
+    }
+
     private static void handlePaste(String name, CommandSender sender, Player player) {
+        // Validate schematic name to prevent path traversal
+        if (!isValidSchematicName(name)) {
+            send(player, "<dark_red><bold>Schematics <reset><red>Invalid name. Use only letters, numbers, hyphens and underscores.");
+            return;
+        }
+
         LPSchematic s = LoParkour.getSchematicManager().getSchematic(name);
         if (s == null) {
             send(sender, LoParkour.PREFIX + "Schematic '" + name + "' not found.");