EngineHub / EngineHub/WorldGuard

Creeper bypasses WorldGuard block protection when a player dies from explosion

Open
#2,284 0 comments 0 reactions 0 assignees View on GitHub
status:pending type:bug
Dominant language
Java
Stars
938
Forks
671
PR merge metrics
No merged PRs in 30d

Description

### WorldEdit Version

* Bukkit-Official(7.4.3-beta-01+80c6d6122)

### WorldGuard Version

* Bukkit-Official (7.0.17+2370-e42d8bc)

### Platform Version

Paper 26.1.2 Build 72

### Confirmations

- [x] I am using the most recent Minecraft release.
- [x] I am using a version of WorldEdit compatible with my Minecraft version.
- [x] I am using a version of WorldGuard compatible with my Minecraft version.
- [x] I am using the latest or recommended version of my platform software.
- [x] I am NOT using a hybrid server, e.g. a server that combines Bukkit and Forge. Examples include Arclight, Mohist, and Cardboard.
- [x] I am NOT using a fork of WorldEdit, such as FastAsyncWorldEdit (FAWE) or AsyncWorldEdit (AWE)

### Bug Description

In WorldGuard-protected regions, creeper explosions normally do not damage blocks. However, there is a bug where block protection is bypassed if a player who is not the owner or a member of the region dies as a result of a creeper explosion inside the region.

### Expected Behavior

Creeper explosions should never damage blocks in a protected WorldGuard region under any circumstances if the player is not the owner or a member of that region.

### Reproduction Steps

1. Enter a WorldGuard-protected region owned by another player.
2. Spawn or lead a creeper into the region.
4. Ensure the player dies from the explosion.

### Optional WorldGuard-Report

_No response_

### Anything Else?

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the issue on Paper 26.1.2 with WorldGuard 7.0.17 and WorldEdit 7.4.3, following the listed creeper-death steps. Trace how the explosion and player death are handled for a protected region, then verify that an explosion never damages blocks when the player is neither owner nor member.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authorization, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.