Prevent item loss on oversized custom-enchant NBT and add safe validation guards and support

cev-api · cev-api · commit 02149b08108a · 2026-04-26T23:56:26.000+10:00
diff --git a/README.md b/README.md
@@ -40,10 +40,19 @@ transfer-xp-cost-enabled: true
 transfer-xp-cost-percent: 50.0
 require-special-book: false
 special-book-ids: []
+max-enchants-per-operation: 16
+max-operation-item-bytes: 24576
 ```
 
 `special-book-ids` accepts namespaced IDs (for example `dingus:blah`).  
 If `special-book-ids` is empty, any non-vanilla namespaced marker is accepted (item model, plugin PDC key, or namespaced display name).
 
+`max-enchants-per-operation` is a safety cap. If a source item has more enchantments than this value, the grindstone operation is blocked to avoid oversized/unstable enchant payload handling.
+`max-operation-item-bytes` is an additional safety cap on serialized item size (source/result/bonus). If any item involved exceeds this size, the operation is blocked to prevent unsafe payload handling.
+
+XP-cost notes:
+- Vanilla enchantments use their estimated enchanting-table costs.
+- Custom enchantments are assigned a rough vanilla-equivalent cost from their level, using the highest matching vanilla cost as the baseline.
+
 ## Compatibility
 Designed for Paper 1.21.11.
diff --git a/build.gradle b/build.gradle
@@ -3,7 +3,7 @@ plugins {
 }
 
 group = 'com.cevapi'
-version = '1.0.1'
+version = '1.0.2'
 
 java {
     toolchain {
diff --git a/src/main/java/com/cevapi/improvedgrindstone/GrindstoneBookPlugin.java b/src/main/java/com/cevapi/improvedgrindstone/GrindstoneBookPlugin.java
@@ -21,6 +21,8 @@ public final class GrindstoneBookPlugin extends JavaPlugin {
     private static final String CONFIG_TRANSFER_XP_COST_PERCENT_KEY = "transfer-xp-cost-percent";
     private static final String CONFIG_REQUIRE_SPECIAL_BOOK_KEY = "require-special-book";
     private static final String CONFIG_SPECIAL_BOOK_IDS_KEY = "special-book-ids";
+    private static final String CONFIG_MAX_ENCHANTS_PER_OPERATION_KEY = "max-enchants-per-operation";
+    private static final String CONFIG_MAX_OPERATION_ITEM_BYTES_KEY = "max-operation-item-bytes";
 
     private boolean featureEnabled;
     private boolean captureCursed;
@@ -31,6 +33,8 @@ public final class GrindstoneBookPlugin extends JavaPlugin {
     private double transferXpCostPercent;
     private boolean requireSpecialBook;
     private Set<String> specialBookIds = new LinkedHashSet<>();
+    private int maxEnchantsPerOperation;
+    private int maxOperationItemBytes;
 
     @Override
     public void onEnable() {
@@ -74,6 +78,9 @@ private void loadConfigValues() {
                 .map(value -> value.toLowerCase(Locale.ROOT).trim())
                 .filter(value -> !value.isEmpty())
                 .collect(Collectors.toCollection(LinkedHashSet::new));
+        maxEnchantsPerOperation = clampPositiveInt(config.getInt(CONFIG_MAX_ENCHANTS_PER_OPERATION_KEY, 16), 1, 200, 16);
+        maxOperationItemBytes = clampPositiveInt(config.getInt(CONFIG_MAX_OPERATION_ITEM_BYTES_KEY, 24576), 1024, 262144,
+                24576);
 
         config.set(CONFIG_KEY, featureEnabled);
         config.set(CONFIG_CAPTURE_CURSED_KEY, captureCursed);
@@ -84,6 +91,8 @@ private void loadConfigValues() {
         config.set(CONFIG_TRANSFER_XP_COST_PERCENT_KEY, transferXpCostPercent);
         config.set(CONFIG_REQUIRE_SPECIAL_BOOK_KEY, requireSpecialBook);
         config.set(CONFIG_SPECIAL_BOOK_IDS_KEY, specialBookIds.stream().toList());
+        config.set(CONFIG_MAX_ENCHANTS_PER_OPERATION_KEY, maxEnchantsPerOperation);
+        config.set(CONFIG_MAX_OPERATION_ITEM_BYTES_KEY, maxOperationItemBytes);
         saveConfig();
     }
 
@@ -171,13 +180,28 @@ public Set<String> getSpecialBookIds() {
         return specialBookIds;
     }
 
+    public int getMaxEnchantsPerOperation() {
+        return maxEnchantsPerOperation;
+    }
+
+    public int getMaxOperationItemBytes() {
+        return maxOperationItemBytes;
+    }
+
     private double clampPercent(double percent) {
         if (Double.isNaN(percent) || Double.isInfinite(percent)) {
             return 50.0d;
         }
         return Math.max(0.0d, Math.min(100.0d, percent));
     }
 
+    private int clampPositiveInt(int value, int min, int max, int fallback) {
+        if (value < min || value > max) {
+            return fallback;
+        }
+        return value;
+    }
+
     @Override
     public void reloadConfig() {
         super.reloadConfig();
diff --git a/src/main/java/com/cevapi/improvedgrindstone/GrindstoneListener.java b/src/main/java/com/cevapi/improvedgrindstone/GrindstoneListener.java
@@ -1,5 +1,7 @@
 package com.cevapi.improvedgrindstone;
 
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
 import java.lang.reflect.Method;
 import java.util.LinkedHashMap;
 import java.util.Locale;
@@ -24,6 +26,7 @@
 import org.bukkit.inventory.meta.EnchantmentStorageMeta;
 import org.bukkit.inventory.meta.ItemMeta;
 import org.bukkit.persistence.PersistentDataContainer;
+import org.bukkit.util.io.BukkitObjectOutputStream;
 
 public final class GrindstoneListener implements Listener {
     private static final Pattern NAMESPACED_ID_PATTERN = Pattern.compile("^[a-z0-9_.-]+:[a-z0-9/._-]+$");
@@ -40,7 +43,13 @@ public void onPrepareGrindstone(PrepareGrindstoneEvent event) {
             return;
         }
 
-        OperationContext context = resolveOperation(event.getInventory());
+        OperationResolution resolution = resolveOperation(event.getInventory());
+        if (resolution.blockedReason() != null) {
+            event.setResult(null);
+            return;
+        }
+
+        OperationContext context = resolution.context();
         if (context != null) {
             event.setResult(context.result());
         }
@@ -74,7 +83,15 @@ public void onInventoryClick(InventoryClickEvent event) {
             return;
         }
 
-        OperationContext context = resolveOperation(inventory);
+        OperationResolution resolution = resolveOperation(inventory);
+        if (resolution.blockedReason() != null) {
+            event.setCancelled(true);
+            player.sendMessage(color("&c" + resolution.blockedReason()));
+            player.playSound(player.getLocation(), Sound.ENTITY_VILLAGER_NO, 0.8f, 0.9f);
+            return;
+        }
+
+        OperationContext context = resolution.context();
         if (context == null) {
             return;
         }
@@ -126,38 +143,51 @@ public void onInventoryDrag(InventoryDragEvent event) {
         event.setCursor(removeOne(cursor));
     }
 
-    private OperationContext resolveOperation(GrindstoneInventory inventory) {
+    private OperationResolution resolveOperation(GrindstoneInventory inventory) {
         ItemStack source = inventory.getItem(0);
         ItemStack secondSlot = inventory.getItem(1);
 
         if (isEmpty(source) || isEmpty(secondSlot)) {
-            return null;
+            return OperationResolution.none();
         }
 
         Map<Enchantment, Integer> enchantments = getEnchantmentsToStore(source);
         if (enchantments.isEmpty()) {
-            return null;
+            return OperationResolution.none();
         }
 
         if (isValidBookForExtraction(secondSlot)) {
             ItemStack result = buildDisenchantedResult(source, enchantments);
             ItemStack bonus = buildEnchantedBook(enchantments);
+            if (bonus == null) {
+                return OperationResolution.blocked("Those enchantments cannot be stored safely in a book.");
+            }
+
+            String validationError = validateOperation(source, result, bonus, enchantments.size());
+            if (validationError != null) {
+                return OperationResolution.blocked(validationError);
+            }
+
             int xpCost = plugin.isBookXpCostEnabled()
                     ? calculateXpCost(enchantments, plugin.getBookXpCostPercent())
                     : 0;
-            return new OperationContext(result, bonus, xpCost, "extract enchantments into a book");
+            return OperationResolution.ready(new OperationContext(result, bonus, xpCost, "extract enchantments into a book"));
         }
 
         if (!plugin.isTransferEnabled() || !isTransferCandidate(source, secondSlot)) {
-            return null;
+            return OperationResolution.none();
         }
 
         ItemStack result = buildTransferredItem(secondSlot, enchantments);
         ItemStack bonus = buildDisenchantedResult(source, enchantments);
+        String validationError = validateOperation(source, result, bonus, enchantments.size());
+        if (validationError != null) {
+            return OperationResolution.blocked(validationError);
+        }
         int xpCost = plugin.isTransferXpCostEnabled()
                 ? calculateXpCost(enchantments, plugin.getTransferXpCostPercent())
                 : 0;
-        return new OperationContext(result, bonus, xpCost, "transfer enchantments to another item");
+        return OperationResolution.ready(new OperationContext(result, bonus, xpCost, "transfer enchantments to another item"));
     }
 
     private boolean handleBookSlotClick(InventoryClickEvent event, GrindstoneInventory inventory) {
@@ -223,11 +253,14 @@ private ItemStack buildEnchantedBook(Map<Enchantment, Integer> enchantments) {
         ItemStack enchantedBook = new ItemStack(Material.ENCHANTED_BOOK);
         EnchantmentStorageMeta meta = (EnchantmentStorageMeta) enchantedBook.getItemMeta();
         if (meta == null) {
-            return enchantedBook;
+            return null;
         }
 
         for (Map.Entry<Enchantment, Integer> entry : enchantments.entrySet()) {
-            meta.addStoredEnchant(entry.getKey(), entry.getValue(), true);
+            boolean added = meta.addStoredEnchant(entry.getKey(), entry.getValue(), true);
+            if (!added) {
+                return null;
+            }
         }
 
         enchantedBook.setItemMeta(meta);
@@ -275,6 +308,38 @@ private Map<Enchantment, Integer> getEnchantmentsToStore(ItemStack input) {
         return filtered;
     }
 
+    private String validateOperation(ItemStack source, ItemStack result, ItemStack bonus, int enchantCount) {
+        if (enchantCount > plugin.getMaxEnchantsPerOperation()) {
+            return "This item has too many enchantments (" + enchantCount + "/" + plugin.getMaxEnchantsPerOperation()
+                    + ") to process safely.";
+        }
+
+        int maxBytes = plugin.getMaxOperationItemBytes();
+        if (estimateSerializedBytes(source) > maxBytes
+                || estimateSerializedBytes(result) > maxBytes
+                || estimateSerializedBytes(bonus) > maxBytes) {
+            return "This item's NBT payload is too large to process safely in the grindstone.";
+        }
+
+        return null;
+    }
+
+    private int estimateSerializedBytes(ItemStack item) {
+        if (isEmpty(item)) {
+            return 0;
+        }
+
+        try (ByteArrayOutputStream baos = new ByteArrayOutputStream();
+                BukkitObjectOutputStream out = new BukkitObjectOutputStream(baos)) {
+            out.writeObject(item);
+            out.flush();
+            return baos.size();
+        } catch (IOException ignored) {
+            // If serialization fails, treat as unsafe rather than risking item loss.
+            return Integer.MAX_VALUE;
+        }
+    }
+
     private int calculateXpCost(Map<Enchantment, Integer> enchantments, double percent) {
         if (percent <= 0.0d) {
             return 0;
@@ -299,6 +364,10 @@ private int estimateEnchantingTableCost(Map<Enchantment, Integer> enchantments)
     }
 
     private int estimateEnchantingTableCost(Enchantment enchantment, int level) {
+        if (!isVanillaEnchantment(enchantment)) {
+            return estimateCustomEquivalentCost(level);
+        }
+
         Integer min = invokeIntWithArg(enchantment, "getMinModifiedCost", level);
         Integer max = invokeIntWithArg(enchantment, "getMaxModifiedCost", level);
 
@@ -326,6 +395,44 @@ private int estimateEnchantingTableCost(Enchantment enchantment, int level) {
         return Math.max(1, 5 + (level * 3));
     }
 
+    private int estimateCustomEquivalentCost(int level) {
+        int safeLevel = Math.max(1, level);
+        int highest = 0;
+        int highestAtMaxVanilla = 0;
+        int highestVanillaLevel = 1;
+
+        for (Enchantment enchantment : Enchantment.values()) {
+            if (!isVanillaEnchantment(enchantment)) {
+                continue;
+            }
+
+            int maxLevel = Math.max(1, enchantment.getMaxLevel());
+            int boundedLevel = Math.min(safeLevel, maxLevel);
+            int cost = estimateEnchantingTableCost(enchantment, boundedLevel);
+            if (cost > highest) {
+                highest = cost;
+            }
+
+            int maxLevelCost = estimateEnchantingTableCost(enchantment, maxLevel);
+            if (maxLevelCost > highestAtMaxVanilla) {
+                highestAtMaxVanilla = maxLevelCost;
+                highestVanillaLevel = maxLevel;
+            }
+        }
+
+        if (highest > 0) {
+            return highest;
+        }
+
+        // Fallback path for atypical environments: keep costs increasing for very high levels.
+        int extrapolated = highestAtMaxVanilla + Math.max(0, safeLevel - highestVanillaLevel) * 6;
+        return Math.max(1, extrapolated);
+    }
+
+    private boolean isVanillaEnchantment(Enchantment enchantment) {
+        return enchantment.getKey().getNamespace().equalsIgnoreCase("minecraft");
+    }
+
     private Integer invokeIntWithArg(Object target, String methodName, int arg) {
         try {
             Method method = target.getClass().getMethod(methodName, int.class);
@@ -555,4 +662,18 @@ private String color(String message) {
 
     private record OperationContext(ItemStack result, ItemStack bonusItem, int xpCostLevels, String xpReason) {
     }
+
+    private record OperationResolution(OperationContext context, String blockedReason) {
+        private static OperationResolution none() {
+            return new OperationResolution(null, null);
+        }
+
+        private static OperationResolution ready(OperationContext context) {
+            return new OperationResolution(context, null);
+        }
+
+        private static OperationResolution blocked(String blockedReason) {
+            return new OperationResolution(null, blockedReason);
+        }
+    }
 }
diff --git a/src/main/resources/config.yml b/src/main/resources/config.yml
@@ -7,3 +7,5 @@ transfer-xp-cost-enabled: true
 transfer-xp-cost-percent: 50.0
 require-special-book: false
 special-book-ids: []
+max-enchants-per-operation: 16
+max-operation-item-bytes: 24576
diff --git a/src/main/resources/plugin.yml b/src/main/resources/plugin.yml
@@ -1,6 +1,6 @@
 name: ImprovedGrindstone
 main: com.cevapi.improvedgrindstone.GrindstoneBookPlugin
-version: 1.0.1
+version: 1.0.2
 api-version: 1.21
 description: Allows grindstone disenchantments to be stored directly into enchanted books.
 author: CevAPI

Original file line number	Diff line number	Diff line change
`@@ -3,7 +3,7 @@ plugins {`
`3`	`3`	`}`
`4`	`4`
`5`	`5`	`group = 'com.cevapi'`
`6`		`-version = '1.0.1'`
	`6`	`+version = '1.0.2'`
`7`	`7`
`8`	`8`	`java {`
`9`	`9`	`toolchain {`