ByteChat

fix: player with chat formatting permission could inject click events into their messages, potentially executing commands on other players' clients

fix: inline tags ([inv], [item], [ec], etc.) displaying as raw placeholder text when combined with gradient or ✨ formatting in the same message

feat: new player-input-serializer config option to control the serializer applied to player-written messages, defaults to LIMITED_MINI_MESSAGE

settings:
  # Format engine used to parse and render the chat format template.
  # This serializer processes server-defined elements such as the player
  # name, separator, prefix, and the 'text' field of each format element.
  # Interactive tags (click, hover) are always available here since this
  # input is server-controlled.
  # Options:
  #  - MINI_MESSAGE     : <gray>, <bold>, <gradient:...>
  #  - LEGACY_AMPERSAND : &a, &b, &l, etc.
  serializer: "MINI_MESSAGE"

  # Format engine used to parse player-written chat messages.
  # This serializer controls what formatting players can use in their messages.
  # Options:
  #  - MINI_MESSAGE         : <gray>, <bold>, <gradient:...>
  #                           Note: use LIMITED_MINI_MESSAGE instead to prevent
  #                           players from injecting click/hover events.
  #  - LIMITED_MINI_MESSAGE : same as MINI_MESSAGE but strips interactive tags
  #                           (click, hover, insertion), preventing exploit vectors
  #                           where players could execute commands on other clients.
  #  - LEGACY_AMPERSAND     : &a, &b, &l, etc.
  #                           Interactive tags are not supported in this engine,
  #                           so no restriction is needed.
  player-input-serializer: "LIMITED_MINI_MESSAGE"