• Make sure to share Qlutch on reddit, youtube, tiktok, twitter, etc for EPIC rewards like free Qlutch Console and CASH! https://minecraftforceop.com/forums/account/referrals Click "What is this?"
  • Qlutch finally has a discord server! Join here https://discord.gg/SnbpTSUVzv

INJECTED BookExploitFix 2021-05-02

No permission to download
Improve the security of your Minecraft server by filtering illegal content from player created books. Books can contain content which executes arbitrary commands, opens links or files on the players computer without any previous indication or warning. Hackers often use these books to trick server staff or other players into giving them access they are not supposed to have.

Originally, this plugin was developed to patch an issue with hack clients on 1.8 servers, where even in survival mode players were able to create books with JSON content. This has been fixed for survival in 1.8.3 but persists for creative mode to this day.

How does it work?
Since version 1.8, book pages are stored as JSON strings, which allow to encode actions when the text is clicked. This includes opening URLs, executing commands, etc. Hackers exploit this by encoding commands like /op and then try to get someone with the appropriate permissions to click the page. In less drastic cases, they can use it to get unsuspecting players to transfer money, give build permissions, etc.

What does the plugin do?
This plugin counters these attempts by filtering the book pages when a player creates or reads a book, removing the potentially harmful actions while preserving the actual text.

Plugin Description


/filter - Actively applies the filter on the book in your hand, useful for testing purposes.
aliases: /bookfilter | /filterbook
permission: bookfilter.filter


CraftBukkit or Spigot version 1.13 or newer
Java 8 or newer
To filter new books created in creative mode, ProtocolLib is required


The plugin allows you to configure which type of content you wish to filter, as well as the player actions on which books are checked. It also supports customization and deactivation of player messages.
Please check the default config for reference: https://github.com/minoneer/BookExploitFix/blob/master/src/main/resources/config.yml

I recommend to "Watch This Resource" as I will push critical fixes as fast as I can. Any feedback and suggestions for improvement are very welcome!

Spigot has fixed the exploit for survival mode in this commit which means in Spigot version 1.8.3 and later. In creative mode, inventories are handled differently and is therefore still affected.

Disclaimer: I have tested this plugin in test and live environments. However, plugins can always contain bugs and unintended behavior. If you use this plugin, you do so on your own risk. I cannot be held responsible for any consequences from using this plugin.
  • Like
Reactions: Blackhat
First release
Last update
0.00 star(s) 0 ratings

More resources from Semegorden