Translation keys can still be read

[NikOverflow]

Describe the bug

I'm the maintainer from https://github.com/NikOverflow/ExploitPreventer
A fabric mod that fixes client side exploits like resource pack local http request stuff, fingerprinting and translation key reading.

Someone reported yesterday an issue that translation keys can still be read and I fixed that issue. Now I tested this client and it is possible too.

In text components we have something that is the with tag. This is for placeholder stuff. For example if I have the following text component: {"translate": "someKey", "with": ["test"]} Now lets say the key exists and in the translation is a %s then the %s will be replaced to test. Now the issue is that with can be a whole text component like that: {"translate": "someKey", "with": [{"translate": "someOtherKey"]} Now it will replace %s with the translation key. The with thing can be recursive so you can have nested withs in it. Of course you also can use keybind and not only translate. The %s cannot only be used in the language file itself. It can also be used in "translate" and "fallback".

Now of course you can fix this whole issue and it is done but I do not recommend it. I would recommend that you just include my mod because then you have not to maintain that part. I'm leading a research group that searches issues like this and try to fix it.

Steps to reproduce

1. Join on a server with a plugin that can get the sign translation the client is sending to the server
2. use this command to create the sign: /setblock ~ ~ ~ oak_sign{front_text:{messages:[{"translate":"%s", "with": [{"translate": "key.category.meteor-client.meteor-client"}]},"","", ""]}} replace
3. Test if it leaks the meteor client translation value.

Meteor Version

1.21.10-33

Minecraft Version

1.21.10

Operating System

Linux

Before submitting a bug report

• This bug wasn't already reported (I have searched bug reports on GitHub).

• This is a valid bug (I am able to reproduce this on the latest dev build).

[Wide-Cat]

We are aware that meteor is currently vulnerable to multiple avenues of attack stemming from the translation exploit, and are currently working on creating our own custom translation system that should (hopefully) fix all attacks stemming from this in one fell swoop - see #5862. Thank you for going out of your way to report this to us, it's a pertinent reminder that there are only going to be more servers exploiting this and that we need to get around to fixing it.

[NikOverflow]

We are aware that meteor is currently vulnerable to multiple avenues of attack stemming from the translation exploit, and are currently working on creating our own custom translation system that should (hopefully) fix all attacks stemming from this in one fell swoop - see #5862. Thank you for going out of your way to report this to us, it's a pertinent reminder that there are only going to be more servers exploiting this and that we need to get around to fixing it.

@Wide-Cat ok but please be careful what you load in the language folder because for example Cytooxien will try everything to load arbitrary files and try to crash the client or detect it.