The bug
Survival players can write raw JSON text components into signs, and they are interpreted. This exposes game internals that should be reserved for players with cheats, similar to MCPE-92635
How to reproduce
1. Enter a world with cheats disabled in survival mode
2. Place a sign
3. Type in this:
{"rawtext":[{"translate":"gameTip.openInventory.touch"}]}
→ ❌ The sign says "Tap the :tip_touch_inventory: button to open your inventory"
Raw translation string IDs, especially unformatted ones, should not be exposed/accessible in survival mode.
Expected behavior
Sign shows exactly what was typed into it, unless you were in creative mode/had cheats enabled.
Attachments
Comments 4
That's right, Bedrock signs can't evaluate selectors per MCPE-115322
It still seems very inappropriate to allow survival players to type a magic code to display arbitrary translation strings. Raw text is a technical feature that seems very intentionally reserved for mapmakers. For the same reason you can't just type raw text directly into chat and expect the game to parse it.
While I do understand where you're coming from, and admire your conviction, I invite you to consider the following:
Re: "It still seems very inappropriate to allow survival players to type a magic code to display arbitrary translation strings". To be fair, they're far from arbitrary and can serve an important role in survival servers, for example where one or more players might prefer a different language than the server's default locale.
Re: "Raw text is a technical feature that seems very intentionally reserved for mapmakers. For the same reason you can't just type raw text directly into chat and expect the game to parse it." Ahh, then you might be surprised to learn that the tellraw command is supported in survival mode as well, and has been for some time. The only tellraw feature that requires cheats to be enabled is selector expansion, allow me to demonstrate:
[media]
In summary, you make a very solid point about the potential for loss of immersion, but it seems to me that Mojang has opted to prioritize multilingual accessibility over perfect survival immersion. Which to me seems perfectly reasonable, all things considered.
What I meant by arbitrary is that all vanilla text exists in translations, and in a domain and implementation-specific form. So yeah being able to turn item.apple.name
into "Apple" across languages makes sense, but there's also strings like these:
gamepad_disconnect.reconnectController
:
Your controller has lost connection. Please reconnect your controller to continue.
verification.nolicense.description
:
We're having trouble verifying that you own Minecraft on this device. Make sure you have downloaded and installed Minecraft from the store. Or simply reconnect to the internet and try again.
title.oldgl2
:
playing in the future as OpenGL 2.0 will be required.
gameTip.breakWood.touch.crosshair.withactionbuttons
:
Tap and hold :tip_virtual_button_action_attack_or_destroy: on a tree to break wood.
The first two are context-specific system messages that should be blatantly inaccessible. There's dozens of these. The third one is only half a line, because it's the second half of a longer message. And the fourth one has a placeholder string in the text that shows up unaltered, which is never intended to be seen.
Why should messages like "Extreme Violence or Gore" (xbox.report.extremeViolence
) be granted the ability to be localized in survival mode, but not "My House"? How do you even explain to a user what they're capable of translating? Whatever random messages vanilla happens to have I guess, in their entirety and nothing else.
Thanks for pointing out about tellraw
, I didn't know that. But I'm not surprised Bedrock made another insane decision about raw text instead of following Java's example.
@tryashtar Does this actually allow for survival players to access sensitive/cheat-restricted info though? As far as I was able to tell from a brief series of tests, this parses the JSON but doesn't actually perform any component resolution. In light of that fact, to me this seems pretty harmless and frankly quite convenient! 👍
For instance,
[media]