Keep external vote service identifiers inert

VotingPlugin/src/main/java/com/bencodez/votingplugin/backendproxy/messaging/BackendProxyMessageRouter.java

@@ -345,7 +345,7 @@ private void handleVoteBroadcast(JsonEnvelope msg) {
 		boolean online = fields.containsKey(VotingPluginWire.K_WAS_ONLINE)
 				? Boolean.parseBoolean(fields.get(VotingPluginWire.K_WAS_ONLINE)) : user.isOnline();
 		plugin.getBroadcastHandler().broadcastVote(user.getJavaUUID(), user.getPlayerName(),
-				voteSite.getDisplayName(), online, totals);
+				voteSite.getDisplayNameForFormatting(), online, totals);
 	}
 
 	private void handleWireVoteDelayRejected(JsonEnvelope msg) {

VotingPlugin/src/main/java/com/bencodez/votingplugin/commands/gui/player/VoteLast.java

@@ -71,7 +71,7 @@ public void onDialog(Player player) {
 				continue;
 			}
 
-			dialog.placeholder("sitename", site.getDisplayName()).button(site.getDisplayName(),
+			dialog.placeholder("sitename", site.getDisplayNameForFormatting()).button(site.getDisplayNameForFormatting(),
 					user.voteCommandLastLine(site), payload -> {
 
 						if (plugin.getGui().isChestVoteLastClickableLinks()) {
@@ -83,7 +83,7 @@ public void onDialog(Player player) {
 
 								HashMap<String, String> placeholders = new HashMap<String, String>();
 								placeholders.put("voteurl", site.getVoteURL());
-								placeholders.put("sitename", site.getDisplayName());
+								placeholders.put("sitename", site.getDisplayNameForFormatting());
 								placeholders.put("player", clicked.getName());
 
 								clickedUser.sendMessage(plugin.getGui().getChestVoteURLURLText(), placeholders);
@@ -121,7 +121,7 @@ public void onChest(Player player) {
 		for (VoteSite site : plugin.getVoteSiteManager().getVoteSitesEnabled()) {
 			if (!site.isHidden()) {
 				inv.addButton(inv.getNextSlot(),
-						new UpdatingBInventoryButton(plugin, site.getItem().setName(site.getDisplayName())
+						new UpdatingBInventoryButton(plugin, site.getItem().setName(site.getDisplayNameForFormatting())
 								.setLore(user.voteCommandLastGUILine(site)).setAmountNone(1), 1000, 1000) {
 
 							@Override
@@ -139,7 +139,7 @@ public void onClick(ClickEvent event) {
 																				plugin.getGui()
 																						.getChestVoteURLURLText(),
 																				"voteurl", site.getVoteURL()),
-																		"sitename", site.getDisplayName()),
+																		"sitename", site.getDisplayNameForFormatting()),
 																"player", player.getName()));
 
 									}
@@ -148,7 +148,7 @@ public void onClick(ClickEvent event) {
 
 							@Override
 							public ItemBuilder onUpdate(Player p) {
-								return site.getItem().setName(site.getDisplayName())
+								return site.getItem().setName(site.getDisplayNameForFormatting())
 										.setLore(user.voteCommandLastGUILine(site)).setAmountNone(1);
 							}
 						});

VotingPlugin/src/main/java/com/bencodez/votingplugin/commands/gui/player/VoteNext.java

@@ -60,7 +60,7 @@ public ArrayList<String> getChat(CommandSender sender) {
 
 				msgLine = MessageAPI.replaceIgnoreCase(msgLine, "%info%", user.voteCommandNextInfo(voteSite));
 
-				msgLine = MessageAPI.replaceIgnoreCase(msgLine, "%SiteName%", voteSite.getDisplayName());
+				msgLine = MessageAPI.replaceIgnoreCase(msgLine, "%SiteName%", voteSite.getDisplayNameForFormatting());
 				msg.add(MessageAPI.colorize(msgLine));
 			}
 		}
@@ -81,10 +81,10 @@ public void onDialog(Player player) {
 			String siteNameDisplay = plugin.getGui().getChestVoteNextCustomSiteNamesDisplays(site.getKey());
 
 			if (siteNameDisplay.isEmpty()) {
-				siteNameDisplay = site.getDisplayName();
+				siteNameDisplay = site.getDisplayNameForFormatting();
 			}
 
-			dialog.placeholder("sitename", site.getDisplayName()).placeholder("SiteName", site.getDisplayName())
+			dialog.placeholder("sitename", site.getDisplayNameForFormatting()).placeholder("SiteName", site.getDisplayNameForFormatting())
 					.placeholder("info", user.voteCommandNextInfo(site))
 					.button(siteNameDisplay, user.voteCommandNextInfo(site), payload -> {
 
@@ -117,7 +117,7 @@ public void onBook(Player player) {
 			if (!site.isHidden()) {
 				Layout nextLayout = new Layout(new ArrayList<>(Arrays.asList("[Json]")));
 				nextLayout.replaceTextComponent("[Json]",
-						BookUtil.TextBuilder.of(book.colorize(site.getDisplayName()))
+						BookUtil.TextBuilder.of(book.colorize(site.getDisplayNameForFormatting()))
 								.onClick(BookUtil.ClickAction.openUrl(site.getVoteURLJsonStrip()))
 								.onHover(BookUtil.HoverAction.showText(user.voteCommandNextInfo(site))).build());
 				book.addLayout(nextLayout);
@@ -141,7 +141,7 @@ public void onChest(Player player) {
 			if (!site.isHidden()) {
 				String siteNameDisplay = plugin.getGui().getChestVoteNextCustomSiteNamesDisplays(site.getKey());
 				if (siteNameDisplay.isEmpty()) {
-					siteNameDisplay = site.getDisplayName();
+					siteNameDisplay = site.getDisplayNameForFormatting();
 				}
 				inv.addButton(inv.getNextSlot(),
 						new UpdatingBInventoryButton(plugin,
@@ -159,7 +159,7 @@ public void onClick(ClickEvent clickEvent) {
 
 							@Override
 							public ItemBuilder onUpdate(Player player) {
-								return site.getItem().setName(site.getDisplayName())
+								return site.getItem().setName(site.getDisplayNameForFormatting())
 										.setLore(user.voteCommandNextInfo(site)).setAmountNone(1)
 										.addPlaceholder("player", user.getPlayerName());
 							}

VotingPlugin/src/main/java/com/bencodez/votingplugin/commands/gui/player/VoteToday.java

@@ -52,9 +52,9 @@ public void onDialog(Player player) {
 				final UUID uuid = topPlayer.getUuid();
 
 				dialog.placeholder("player", topPlayer.getPlayerName()).placeholder("votesite", voteSite.getKey())
-						.placeholder("sitename", voteSite.getDisplayName())
-						.placeholder("SiteName", voteSite.getDisplayName())
-						.placeholder("VoteSite", voteSite.getDisplayName()).placeholder("time", timeString)
+						.placeholder("sitename", voteSite.getDisplayNameForFormatting())
+						.placeholder("SiteName", voteSite.getDisplayNameForFormatting())
+						.placeholder("VoteSite", voteSite.getDisplayNameForFormatting()).placeholder("time", timeString)
 						.placeholder("Time", timeString).button("&e" + topPlayer.getPlayerName(),
 								plugin.getConfigFile().getFormatCommandsVoteTodayLine(), payload -> {
 									Player clicked = player.getServer().getPlayer(payload.owner());
@@ -136,9 +136,9 @@ public void onChest(Player player) {
 				HashMap<String, String> placeholders = new HashMap<>();
 				placeholders.put("player", user.getPlayerName());
 				placeholders.put("votesite", voteSite.getKey());
-				placeholders.put("sitename", voteSite.getDisplayName());
-				placeholders.put("SiteName", voteSite.getDisplayName());
-				placeholders.put("VoteSite", voteSite.getDisplayName());
+				placeholders.put("sitename", voteSite.getDisplayNameForFormatting());
+				placeholders.put("SiteName", voteSite.getDisplayNameForFormatting());
+				placeholders.put("VoteSite", voteSite.getDisplayNameForFormatting());
 				placeholders.put("time", timeString);
 				placeholders.put("Time", timeString);
 
@@ -204,7 +204,7 @@ public String[] voteToday() {
 				HashMap<String, String> placeholders = new HashMap<>();
 				placeholders.put("player", user.getPlayerName());
 				placeholders.put("votesite", voteSite.getKey());
-				placeholders.put("sitename", voteSite.getDisplayName());
+				placeholders.put("sitename", voteSite.getDisplayNameForFormatting());
 				placeholders.put("time", timeString);
 				msg.add(PlaceholderUtils.replacePlaceHolder(plugin.getConfigFile().getFormatCommandsVoteTodayLine(),
 						placeholders));
@@ -234,7 +234,7 @@ public String[] voteTodayGUI() {
 				HashMap<String, String> placeholders = new HashMap<>();
 				placeholders.put("player", user.getPlayerName());
 				placeholders.put("votesite", mostRecentSite.getKey());
-				placeholders.put("sitename", mostRecentSite.getDisplayName());
+				placeholders.put("sitename", mostRecentSite.getDisplayNameForFormatting());
 				placeholders.put("time", timeString);
 				msg.add(PlaceholderUtils.replacePlaceHolder(plugin.getConfigFile().getFormatCommandsVoteTodayLine(),
 						placeholders));

VotingPlugin/src/main/java/com/bencodez/votingplugin/commands/gui/player/VoteURL.java

@@ -71,7 +71,7 @@ public ArrayList<String> getChat(CommandSender sender, boolean bypassCanVote) {
 									plugin.getConfigFile().getFormatCommandsVoteURLS());
 							message.replacePlaceholder("num", Integer.toString(counter))
 									.replacePlaceholder("url", voteURL)
-									.replacePlaceholder("SiteName", voteSite.getDisplayName());
+									.replacePlaceholder("SiteName", voteSite.getDisplayNameForFormatting());
 							if (user != null && user.getPlayerName() != null) {
 								message.replacePlaceholder("player", "" + user.getPlayerName())
 										.replacePlaceholder("Next", "" + user.voteCommandNextInfo(voteSite));
@@ -150,14 +150,14 @@ public void onDialog(Player player) {
 			boolean canVote = finalUser.canVoteSite(voteSite);
 			String color = canVote ? "&a" : "&c";
 
-			dialog.placeholder("sitename", voteSite.getDisplayName())
-					.placeholder("SiteName", voteSite.getDisplayName())
-					.placeholder("servicesite", voteSite.getServiceSite())
-					.placeholder("ServiceSite", voteSite.getServiceSite())
+			dialog.placeholder("sitename", voteSite.getDisplayNameForFormatting())
+					.placeholder("SiteName", voteSite.getDisplayNameForFormatting())
+					.placeholder("servicesite", voteSite.getServiceSiteForFormatting())
+					.placeholder("ServiceSite", voteSite.getServiceSiteForFormatting())
 					.placeholder("VoteDelay", "" + voteSite.getVoteDelay())
 					.placeholder("VoteHour", "" + voteSite.getVoteDelayDailyHour())
 					.placeholder("Next", finalUser.voteCommandNextInfo(voteSite))
-					.button(color + voteSite.getDisplayName(),
+					.button(color + voteSite.getDisplayNameForFormatting(),
 							canVote ? "&aClick to view vote link" : "&c" + finalUser.voteCommandNextInfo(voteSite),
 							payload -> {
 								Player clicked = player.getServer().getPlayer(payload.owner());
@@ -166,9 +166,9 @@ public void onDialog(Player player) {
 											.getVotingPluginUser(clicked);
 									HashMap<String, String> placeholders = new HashMap<String, String>();
 									placeholders.put("voteurl", voteSite.getVoteURL());
-									placeholders.put("sitename", voteSite.getDisplayName());
+									placeholders.put("sitename", voteSite.getDisplayNameForFormatting());
 									placeholders.put("player", clicked.getName());
-									placeholders.put("servicesite", voteSite.getServiceSite());
+									placeholders.put("servicesite", voteSite.getServiceSiteForFormatting());
 									placeholders.put("VoteDelay", "" + voteSite.getVoteDelay());
 									placeholders.put("VoteHour", "" + voteSite.getVoteDelayDailyHour());
 									clickedUser.sendMessage(plugin.getGui().getChestVoteURLURLText(), placeholders);
@@ -218,8 +218,8 @@ private ItemBuilder getItemVoteSite(VoteSite voteSite) {
 			builder.setName(plugin.getGui().getChestVoteURLGUISiteName());
 			builder.addLoreLine(plugin.getGui().getChestVoteURLNextVote());
 		}
-		builder.addPlaceholder("ServiceSite", voteSite.getServiceSite());
-		builder.addPlaceholder("Name", voteSite.getDisplayName());
+		builder.addPlaceholder("ServiceSite", voteSite.getServiceSiteForFormatting());
+		builder.addPlaceholder("Name", voteSite.getDisplayNameForFormatting());
 		builder.addPlaceholder("VoteDelay", "" + voteSite.getVoteDelay());
 		builder.addPlaceholder("VoteHour", "" + voteSite.getVoteDelayDailyHour());
 		builder.addPlaceholder("Info", user.voteCommandNextInfo(voteSite));
@@ -240,7 +240,7 @@ public void onBook(Player player) {
 			if (!site.isHidden()) {
 				if (site.getPermissionToView().isEmpty() || player.hasPermission(site.getPermissionToView())) {
 					Layout layout = new Layout(plugin.getGui().getBookVoteURLBookGUILayout())
-							.addPlaceholder("sitename", site.getDisplayName()).addPlaceholder("num", "" + i);
+							.addPlaceholder("sitename", site.getDisplayNameForFormatting()).addPlaceholder("num", "" + i);
 					String text = plugin.getGui().getBookVoteURLBookGUIAlreadyVotedText();
 					ChatColor color = ChatColor.valueOf(plugin.getGui().getBookVoteURLBookGUIAlreadyVotedColor());
 					if (user.canVoteSite(site)) {
@@ -342,9 +342,9 @@ public void onClick(ClickEvent event) {
 								VotingPluginUser user = plugin.getVotingPluginUserManager().getVotingPluginUser(player);
 								HashMap<String, String> placeholders = new HashMap<>();
 								placeholders.put("voteurl", voteSite.getVoteURL());
-								placeholders.put("sitename", voteSite.getDisplayName());
+								placeholders.put("sitename", voteSite.getDisplayNameForFormatting());
 								placeholders.put("player", player.getName());
-								placeholders.put("servicesite", voteSite.getServiceSite());
+								placeholders.put("servicesite", voteSite.getServiceSiteForFormatting());
 								placeholders.put("VoteDelay", "" + voteSite.getVoteDelay());
 								placeholders.put("VoteHour", "" + voteSite.getVoteDelayDailyHour());
 								user.sendMessage(plugin.getGui().getChestVoteURLURLText(), placeholders);

VotingPlugin/src/main/java/com/bencodez/votingplugin/commands/gui/player/VoteURLVoteSite.java

@@ -53,7 +53,7 @@ public void onChest(Player player) {
 		}
 		VoteSite site = plugin.getVoteSiteManager().getVoteSite(voteSite, true);
 		BInventory inv = new BInventory(plugin.getGui().getChestVoteURLSiteName());
-		inv.addPlaceholder("site", site.getDisplayName());
+		inv.addPlaceholder("site", site.getDisplayNameForFormatting());
 		inv.setMeta(player, "VoteSite", site);
 		if (!plugin.getConfigFile().isAlwaysCloseInventory()) {
 			inv.dontClose();
@@ -117,9 +117,10 @@ public void onDialog(Player player) {
 		VoteSite site = plugin.getVoteSiteManager().getVoteSite(voteSite, true);
 
 		com.bencodez.simpleapi.dialog.MultiActionDialogBuilder dialog = plugin.getDialogService().multiAction(player)
-				.placeholder("player", user.getPlayerName()).placeholder("site", site.getDisplayName())
-				.placeholder("sitename", site.getDisplayName()).placeholder("SiteName", site.getDisplayName())
-				.placeholder("servicesite", site.getServiceSite()).placeholder("ServiceSite", site.getServiceSite())
+				.placeholder("player", user.getPlayerName()).placeholder("site", site.getDisplayNameForFormatting())
+				.placeholder("sitename", site.getDisplayNameForFormatting()).placeholder("SiteName", site.getDisplayNameForFormatting())
+				.placeholder("servicesite", site.getServiceSiteForFormatting())
+				.placeholder("ServiceSite", site.getServiceSiteForFormatting())
 				.placeholder("VoteDelay", "" + site.getVoteDelay())
 				.placeholder("VoteHour", "" + site.getVoteDelayDailyHour())
 				.placeholder("Next", user.voteCommandNextInfo(site)).placeholder("Last", user.voteCommandLastLine(site))

VotingPlugin/src/main/java/com/bencodez/votingplugin/config/ConfigVoteSites.java

@@ -80,14 +80,14 @@ private boolean tryGenerateVoteSite(String siteName, boolean automatic) {
 			String org = siteName;
 			siteName = siteName.replaceAll("[\\.\\s]+", "_");
 
-			plugin.getLogger().warning("Creating VoteSite " + siteName + " for the service site '" + org + "'");
-			setEnabled(siteName, true);
-			setServiceSite(siteName, org);
-			setVoteURL(siteName, "VoteURL");
+			plugin.getLogger().warning("Creating VoteSite " + siteName + " for the service site '" + org + "'");
+			setEnabled(siteName, true);
+			setServiceSite(siteName, org);
+			setVoteURL(siteName, "VoteURL");
 			setVoteDelay(siteName, "24h");
 			set(siteName, "DisplayItem.Material", "STONE");
 			set(siteName, "DisplayItem.Amount", 1);
-			set(siteName, "Rewards.Messages.Player", "&aThanks for voting on %ServiceSite%!");
+			set(siteName, "Rewards.Messages.Player", "&aThanks for voting on %SiteName%!");
 			set(siteName, "WaitUntilVoteDelayRewards", Collections.emptyMap());
 
 			plugin.loadVoteSites();

VotingPlugin/src/main/java/com/bencodez/votingplugin/cooldown/CoolDownCheck.java

@@ -280,6 +280,7 @@ public void onCoolDownEnd(PlayerVoteCoolDownEndEvent event) {
 	public void onCoolDownEnd(PlayerVoteSiteCoolDownEndEvent event) {
 		plugin.getRewardHandler().giveReward(event.getPlayer(), event.getSite().getSiteData(), "CoolDownEndRewards",
 				new RewardOptions().addPlaceholder("sitename", event.getSite().getDisplayName())
+						.addDisplayPlaceholder("sitename", event.getSite().getDisplayNameForFormatting())
 						.addPlaceholder("url", event.getSite().getVoteURL(false)));
 	}
 

VotingPlugin/src/main/java/com/bencodez/votingplugin/listeners/PlayerVoteListener.java

@@ -95,7 +95,7 @@ private BukkitOperations(VotingPluginMain plugin, PlayerVoteEvent event) {
         }
         @Override public boolean siteEnabled(VoteSite site) { return site.isEnabled(); }
         @Override public String siteKey(VoteSite site) { return site.getKey(); }
-        @Override public String siteDisplayName(VoteSite site) { return site.getDisplayName(); }
+        @Override public String siteDisplayName(VoteSite site) { return site.getDisplayNameForFormatting(); }
         @Override public VotingPluginUser resolveUser(String name) {
             if (event.getVotingPluginUser() != null) return event.getVotingPluginUser();
             Player player = Bukkit.getPlayerExact(name);

VotingPlugin/src/main/java/com/bencodez/votingplugin/user/VotingPluginUser.java

@@ -2652,7 +2652,7 @@ public String voteCommandLastGUILine(VoteSite voteSite) {
 
 		HashMap<String, String> placeholders = new HashMap<>();
 		placeholders.put("time", timeString);
-		placeholders.put("SiteName", voteSite.getDisplayName());
+		placeholders.put("SiteName", voteSite.getDisplayNameForFormatting());
 		placeholders.put("timesince", timeSince);
 
 		return PlaceholderUtils.replacePlaceHolder(plugin.getGui().getChestVoteLastLine(), placeholders);
@@ -2670,7 +2670,7 @@ public String voteCommandLastLine(VoteSite voteSite) {
 
 		HashMap<String, String> placeholders = new HashMap<>();
 		placeholders.put("time", timeString);
-		placeholders.put("SiteName", voteSite.getDisplayName());
+		placeholders.put("SiteName", voteSite.getDisplayNameForFormatting());
 		placeholders.put("timesince", timeSince);
 
 		return PlaceholderUtils.replacePlaceHolder(plugin.getConfigFile().getFormatCommandsVoteLastLine(),

VotingPlugin/src/main/java/com/bencodez/votingplugin/util/ServiceSiteValidator.java

@@ -7,6 +7,7 @@ public final class ServiceSiteValidator {
 	/** Maximum accepted UTF-16 length for a service-site identifier. */
 	public static final int MAX_LENGTH = 2048;
 	private static final int MAX_LOG_LENGTH = 128;
+	private static final String FORMATTING_BOUNDARY = "\u2060";
 
 	private ServiceSiteValidator() {
 	}
@@ -16,7 +17,7 @@ private ServiceSiteValidator() {
 	 *
 	 * @param serviceSite service-site name supplied by a vote source
 	 * @return {@code true} for a bounded, visible service-site name that does not
-	 *         contain unsupported delimiters
+	 *         contain structural formatting delimiters or control characters
 	 */
 	public static boolean isValid(String serviceSite) {
 		if (serviceSite == null || serviceSite.length() > MAX_LENGTH) {
@@ -65,9 +66,27 @@ public static String sanitizeForLog(String value) {
 		return sanitized.toString();
 	}
 
+	/**
+	 * Keeps a validated external identifier visually unchanged while preventing a
+	 * surrounding trusted template from completing a formatting token across a
+	 * substitution boundary.
+	 */
+	public static String inertForFormatting(String value) {
+		if (value == null || value.isEmpty()) return value == null ? "" : value;
+		StringBuilder inert = new StringBuilder(value.length() + 2).append(FORMATTING_BOUNDARY);
+		for (int offset = 0; offset < value.length();) {
+			int codePoint = value.codePointAt(offset);
+			inert.appendCodePoint(codePoint);
+			if (codePoint == '%' || codePoint == '&') inert.append(FORMATTING_BOUNDARY);
+			offset += Character.charCount(codePoint);
+		}
+		return inert.append(FORMATTING_BOUNDARY).toString();
+	}
+
 	private static boolean isDisallowed(int codePoint) {
 		if (codePoint == '[' || codePoint == ']' || codePoint == '\'' || codePoint == '"' || codePoint == '`'
-				|| codePoint == '\\') {
+				|| codePoint == '\u00A7'
+				|| codePoint == '\\' || codePoint == '{' || codePoint == '}') {
 			return true;
 		}