Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 5 additions & 3 deletions build.gradle
Original file line number Diff line number Diff line change
Expand Up @@ -11,15 +11,17 @@ repositories {

group = 'net.minecraft'
archivesBaseName = 'launchwrapper'
version = '1.12'
version = '1.13'
sourceCompatibility = 1.6

dependencies {
compile 'net.sf.jopt-simple:jopt-simple:4.5'
compile 'org.ow2.asm:asm-debug-all:5.0.3'
compile 'org.lwjgl.lwjgl:lwjgl:2.9.1'
compile 'org.apache.logging.log4j:log4j-core:2.0-beta9'
compile 'org.apache.logging.log4j:log4j-api:2.0-beta9'
compile 'org.apache.logging.log4j:log4j-core:2.16.0'
compile 'org.apache.logging.log4j:log4j-api:2.16.0'
compile 'org.apache.logging.log4j:log4j-slf4j18-impl:2.16.0'
compile 'com.mojang:authlib:2.3.31'
}

task sourcesJar(type: Jar) {
Expand Down
4 changes: 4 additions & 0 deletions src/main/java/net/minecraft/launchwrapper/Launch.java
Original file line number Diff line number Diff line change
Expand Up @@ -15,9 +15,12 @@
import java.util.List;
import java.util.Map;
import java.util.Set;
import java.net.URL;

import org.apache.logging.log4j.Level;

import net.minecraft.launchwrapper.protocol.LegacyProtocolURLStreamHandlerFactory;

public class Launch {
private static final String DEFAULT_TWEAK = "net.minecraft.launchwrapper.VanillaTweaker";
public static File minecraftHome;
Expand All @@ -31,6 +34,7 @@ public static void main(String[] args) {
public static LaunchClassLoader classLoader;

private Launch() {
URL.setURLStreamHandlerFactory(new LegacyProtocolURLStreamHandlerFactory());
final URLClassLoader ucl = (URLClassLoader) getClass().getClassLoader();
classLoader = new LaunchClassLoader(ucl.getURLs());
blackboard = new HashMap<String,Object>();
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,98 @@
package net.minecraft.launchwrapper.protocol;

import java.io.IOException;
import java.io.InputStream;
import java.net.HttpURLConnection;
import java.net.URL;
import java.util.Map;
import java.net.Proxy;

import com.mojang.authlib.minecraft.MinecraftProfileTexture;
import com.mojang.authlib.ProfileLookupCallback;
import com.mojang.authlib.GameProfile;
import com.mojang.authlib.Agent;
import com.mojang.authlib.yggdrasil.YggdrasilAuthenticationService;

public class CapeURLConnection extends HttpURLConnection {

public final static String[] OLD_CAPE_ADDRESSES = new String[] {
"http://www.minecraft.net/cloak/get.jsp?user=", // Introduced Beta 1.0 (when capes were added)
"http://s3.amazonaws.com/MinecraftCloaks/", // Introduced Beta 1.2
"http://skins.minecraft.net/MinecraftCloaks/" // Introduced Release 1.3.1
};

public CapeURLConnection(URL url) {
super(url);
}

@Override
public void disconnect() {
}

@Override
public boolean usingProxy() {
return false;
}

InputStream inputStream = null;
int responseCode = 200;

private String getUsernameFromURL() {
String username = this.url.toString();

// We get the username from the skin by replacing the url up to the username with whitespace.
for (String oldCapeAddress : OLD_CAPE_ADDRESSES) {
username = username.replace(oldCapeAddress, "");
}
/// ... and dropping the .png.
username = username.replace(".png", "");

return username;
}

@Override
public void connect() throws IOException {
String username = getUsernameFromURL();

try {
MinecraftProfileTexture cape = getUserCape(username);
inputStream = new URL(cape.getUrl()).openConnection().getInputStream();
} catch (Exception ex) {
responseCode = 404;
}
}

YggdrasilAuthenticationService authenticationService = new YggdrasilAuthenticationService(Proxy.NO_PROXY, (String)null);
GameProfile gameProfile = null;

private MinecraftProfileTexture getUserCape(String username) {
authenticationService.createProfileRepository().findProfilesByNames(new String[] { username }, Agent.MINECRAFT, new ProfileLookupCallback() {
public void onProfileLookupSucceeded(GameProfile paramGameProfile) {
gameProfile = paramGameProfile;
}
public void onProfileLookupFailed(GameProfile paramGameProfile, Exception paramException) {
}
});

if (gameProfile == null)
return null;

gameProfile = authenticationService.createMinecraftSessionService().fillProfileProperties(gameProfile, true);

Map<MinecraftProfileTexture.Type, MinecraftProfileTexture> textures = authenticationService.createMinecraftSessionService().getTextures(gameProfile, true);
if (textures.containsKey(MinecraftProfileTexture.Type.CAPE))
return textures.get(MinecraftProfileTexture.Type.CAPE);

return null;
}

@Override
public InputStream getInputStream() throws IOException {
return inputStream;
}

@Override
public int getResponseCode() {
return responseCode;
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,98 @@
package net.minecraft.launchwrapper.protocol;

import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.InputStream;
import java.net.HttpURLConnection;
import java.net.URL;
import java.net.Proxy;
import java.util.Map;
import java.util.HashMap;

import com.mojang.authlib.ProfileLookupCallback;
import com.mojang.authlib.GameProfile;
import com.mojang.authlib.Agent;
import com.mojang.authlib.exceptions.AuthenticationException;
import com.mojang.authlib.yggdrasil.YggdrasilAuthenticationService;

public class JoinServerURLConnection extends HttpURLConnection {
public JoinServerURLConnection(URL url) {
super(url);
}

@Override
public void disconnect() {

}

@Override
public boolean usingProxy() {
return false;
}

private String response = "bad login";

@Override
public void connect() throws IOException {

}

YggdrasilAuthenticationService authenticationService = new YggdrasilAuthenticationService(Proxy.NO_PROXY, (String)null);

GameProfile gameProfile = null;

@Override
public InputStream getInputStream() throws IOException {
// Pull params from the URL query.
String[] params = this.url.getQuery().split("&");
Map<String, String> queryMap = new HashMap<String, String>();

for (String param : params) {
String name = param.split("=")[0];
String value = param.split("=")[1];
queryMap.put(name, value);
}

String username = queryMap.get("user");
// sessionId is token:<accessToken>:<playerId>. We want the access token.
String accessToken = queryMap.get("sessionId").split(":")[1];
String serverId = queryMap.get("serverId");

// Lookup the game profile by username.
authenticationService.createProfileRepository().findProfilesByNames(new String[] { username }, Agent.MINECRAFT, new ProfileLookupCallback() {
public void onProfileLookupSucceeded(GameProfile paramGameProfile) {
gameProfile = paramGameProfile;
}
public void onProfileLookupFailed(GameProfile paramGameProfile, Exception paramException) {
}
});

if (gameProfile == null)
return null;

// Send the join request.
try {
authenticationService.createMinecraftSessionService().joinServer(
gameProfile,
accessToken,
serverId
);

response = "ok";
} catch (AuthenticationException ex) {
// response defaults to "bad login"
}

return new ByteArrayInputStream(response.getBytes());
}

@Override
public int getResponseCode() {
return 200;
}

@Override
public String getResponseMessage() {
return "ok";
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,42 @@
package net.minecraft.launchwrapper.protocol;

import java.io.IOException;
import java.net.URL;
import java.net.Proxy;
import java.net.URLConnection;
import java.net.URLStreamHandler;

public class LegacyProtocolURLStreamHandler extends URLStreamHandler {
private final Class<? extends URLConnection> defaultHttpConnectionClass;

public LegacyProtocolURLStreamHandler(Class<? extends URLConnection> _defaultHttpConnectionClass) {
defaultHttpConnectionClass = _defaultHttpConnectionClass;
}

@Override
protected URLConnection openConnection(URL url) throws IOException {
// Skins are pulled from the new endpoint and converted to the legacy format as required.
for (String oldSkinAddress : SkinURLConnection.OLD_SKIN_ADDRESSES) {
if (url.toString().startsWith(oldSkinAddress))
return new SkinURLConnection(url);
}

// Capes are pulled from the new endpoint, no conversion is required.
for (String oldCapeAddress : CapeURLConnection.OLD_CAPE_ADDRESSES) {
if (url.toString().startsWith(oldCapeAddress))
return new CapeURLConnection(url);
}

// Server authentication is done over a newer endpoint.
if (url.toString().startsWith("http://www.minecraft.net/game/joinserver.jsp")) {
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To add additional safety features for Beta 1.8+, this should not only support "www.minecraft.net", but also (the still working, but terrible security wise) "session.minecraft.net". Besides the different subdomain, rest of the URL is the same (and the difference doesn't matter later on, see: JoinServerURLConnection#getInputStream).

Copy link
Author

@craftycodie craftycodie Feb 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

still working, but terrible security wise

could you explain this conclusion?

Copy link

@Lort533 Lort533 Feb 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same as with "www.minecraft.net":

  • still using HTTP,
  • server ID and token are still passed through the URL parameters.

Again, the only difference between "www.minecraft.net" and "session.minecraft.net" (besides the latter still working) is the subdomain, rest of the URL remains the same and rest of the code doesn't rely on the subdomain so I'm guessing it should be straight up compatible.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Got it, thanks

return new JoinServerURLConnection(url);
}

try {
return defaultHttpConnectionClass.getConstructor(URL.class, Proxy.class).newInstance(url, Proxy.NO_PROXY);
} catch (Exception e) {
// If the constructor isn't found, you can log that out. It's not expected.
return null;
}
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
package net.minecraft.launchwrapper.protocol;

import java.net.URL;
import java.net.URLConnection;
import java.net.URLStreamHandler;
import java.net.URLStreamHandlerFactory;

public class LegacyProtocolURLStreamHandlerFactory implements URLStreamHandlerFactory {
private final Class<? extends URLConnection> defaultHttpConnectionClass;

public LegacyProtocolURLStreamHandlerFactory() {
try {
URL foo = new URL("http://example.com");
// Doesn't actually establish a connection
defaultHttpConnectionClass = foo.openConnection().getClass();
} catch (Exception e) {
// this should never happen as the URL is hardcoded, shouldn't be invalid.
throw new RuntimeException(e);
}
}

@Override
public URLStreamHandler createURLStreamHandler(String protocol) {
if ("http".equals(protocol)) {
return new LegacyProtocolURLStreamHandler(defaultHttpConnectionClass);
}

return null;
}
}
Loading