Folia: Cause.Builder reads Creature#getTarget() from a non-owning region during vehicle damage

[baichuan335]

WorldEdit Version

WorldEdit 7.4.3+7515-78babeb

WorldGuard Version

WorldGuard 7.0.17+2370-e42d8bc

Platform Version

• Official Folia 1.21.11-14-ver/1.21.11@529aabc
• Minecraft 1.21.11
• Java 25.0.3
• Four Folia region tick threads

The Folia server JAR was downloaded from PaperMC's official download service.

Confirmations

• I am using the most recent Minecraft release.
• I am using a version of WorldEdit compatible with my Minecraft version.
• I am using a version of WorldGuard compatible with my Minecraft version.
• I am using the latest or recommended version of my platform software.
• I am NOT using a hybrid server, e.g. a server that combines Bukkit and Forge.
• I am NOT using a fork of WorldEdit, such as FastAsyncWorldEdit or AsyncWorldEdit.

Bug Description

When a projectile has a Creature shooter owned by a different Folia region, WorldGuard reads the shooter's mutable AI state from the projectile or vehicle region thread while building the event cause chain.

The problem is in Cause.Builder.addAll(...). After following Projectile#getShooter(), WorldGuard reaches the remote Creature and unconditionally calls Creature#getTarget(). Folia correctly rejects this read because the current region does not own the creature.

This was reproduced on an isolated official Folia server. Immediately before firing VehicleDamageEvent, the ownership checks returned:

Bukkit.isOwnedByCurrentRegion(arrow)    = true
Bukkit.isOwnedByCurrentRegion(pillager) = false

WorldGuard then produced this call path:

Thread failed main thread check: Accessing entity state off owning region's thread
at ca.spottedleaf.moonrise.common.util.TickThread.ensureTickThread(TickThread.java:97)
at org.bukkit.craftbukkit.entity.CraftPillager.getHandle(CraftPillager.java:16)
at org.bukkit.craftbukkit.entity.CraftMob.getTarget(CraftMob.java:71)
at com.sk89q.worldguard.bukkit.cause.Cause$Builder.addAll(Cause.java:336)
at com.sk89q.worldguard.bukkit.cause.Cause$Builder.addAll(Cause.java:298)
at com.sk89q.worldguard.bukkit.cause.Cause.create(Cause.java:226)
at com.sk89q.worldguard.bukkit.listener.EventAbstractionListener.onVehicleDamage(EventAbstractionListener.java:1005)

The exception aborts the WorldGuard listener before it completes its protection check. The VehicleDamageEvent returns without being cancelled, so a protected vehicle may remain vulnerable.

Expected Behavior

WorldGuard should keep the projectile and its shooter in the cause chain without reading mutable state from an entity owned by another Folia region.

If the current region owns the creature, WorldGuard may continue resolving getTarget() and getIgniter(). If it does not own the creature, WorldGuard should skip only that recursive AI-state expansion and continue processing the event normally.

Reproduction Steps

1. Start official Folia 1.21.11-14 (529aabc) with four region tick threads and Java 25.
2. Install WorldEdit 7.4.3+7515-78babeb and WorldGuard 7.0.17+2370-e42d8bc.
3. In region A near x=0, create a persistent pillager.
4. Create an arrow in region A and assign the pillager as its shooter.
5. Move the arrow to region B near x=16384 with teleportAsync(...), leaving the pillager in region A.
6. On the arrow's entity scheduler in region B, create a minecart and fire a real Bukkit VehicleDamageEvent with the arrow as the attacker.
7. Confirm that Bukkit.isOwnedByCurrentRegion(arrow) is true and Bukkit.isOwnedByCurrentRegion(pillager) is false on the event thread.
8. Observe WorldGuard calling CraftMob#getTarget() through Cause.Builder.addAll(...) and Folia rejecting the cross-region entity-state read.

The test uses a deterministic event harness to isolate WorldGuard's listener. It does not modify WorldGuard or Folia internals.

Optional WorldGuard-Report

Not applicable. This failure occurs while WorldGuard constructs the event cause, before a region-specific protection result can be completed.

Anything Else?

The relevant WorldGuard logic currently reads creature state recursively without checking Folia ownership:

} else if (o instanceof Creeper creeper) {
    indirect = true;
    addAll(creeper.getTarget(), creeper.getIgniter());
} else if (o instanceof Creature creature) {
    indirect = true;
    addAll(creature.getTarget());
}

A possible fix is to preserve the creature as a cause but guard only the mutable target and igniter lookups:

} else if (o instanceof Creeper creeper) {
    indirect = true;
    if (!WorldGuardPlugin.inst().isFolia()
            || Bukkit.isOwnedByCurrentRegion(creeper)) {
        addAll(creeper.getTarget(), creeper.getIgniter());
    }
} else if (o instanceof Creature creature) {
    indirect = true;
    if (!WorldGuardPlugin.inst().isFolia()
            || Bukkit.isOwnedByCurrentRegion(creature)) {
        addAll(creature.getTarget());
    }
}

Bukkit.isOwnedByCurrentRegion(Entity) is suitable here because it checks ownership without first reading the remote entity's location or other owner-only state.

Moving cause construction to the shooter's scheduler is not a safe replacement: vehicle-event cancellation must finish synchronously on the vehicle's owning region, and blocking one region while waiting for another can introduce deadlocks or tick latency.

[baichuan335]

A fix has now been implemented and submitted as #2312.

The change keeps the projectile and remote creature shooter in the cause chain, but on Folia it only expands mutable creature AI state (Creature#getTarget() and Creeper#getTarget() / getIgniter()) when Bukkit.isOwnedByCurrentRegion(creature) is true. Non-Folia behavior and locally owned Folia creatures keep the existing expansion behavior.

Validation completed:

• WorldGuard branch build: ./gradlew.bat build -s --max-workers=1
  • Passed, including tests, Checkstyle, header verification, and packaging.
• Original-version runtime environment:
  • Official Folia 1.21.11-14, commit 529aabc
  • WorldEdit 7.4.3+7515-78babeb
  • WorldGuard 7.0.17 with the fix applied
  • Temurin Java 25.0.4.1
  • Four Region tick threads
• Deterministic ownership assertions immediately before the vehicle event:
  • projectile-owned-by-current=true
  • shooter-owned-by-current=false
• Protection-result verification:
  • Global vehicle-destroy: deny was configured successfully.
  • VehicleDamageEvent returned normally with cancelled=true.
• The runtime log contained no Thread failed main thread check, no cross-Region CraftMob.getTarget() exception, and no other exception/error output from the test.

PR: #2312

The upstream GitHub Actions run currently requires maintainer approval because the PR comes from a fork; the local build and official Folia runtime verification above are complete independently of that approval.