Your_average_minecrafter Minecraft's rich text format has two problematic features: translated text and keybind text.
Translated text takes a given translation key, for example gui.cancel
, and displays it in the client's preferred language, for example Cancel
in English or Abbrechen
in German. If the client has no translations for the given key, it instead displays the key itself, so for example you would see gui.cancel
displayed on the cancel button.
Keybind text is similar, but it assumes that the translation key is for a keybind and displays what button that keybind is set to. For example, a translatable text of key.forward
resolves to Walk Forwards
in English, but a keybind text of key.forward
resolves to W
with the default keybinds.
What makes these features problematic is that they also work with modded translations and keybinds. For example, keybind text for of.key.zoom
might display C
if OptiFine is installed, but it will always display of.key.zoom
if OptiFine is not installed.
Normally that's not a huge issue, since this text is only displayed on your screen. The fact that a server can send you this kind of text almost anywhere is quite sketchy though.
But when you edit a sign, all of its content is turned into plain text so that you can edit it. That means any translation/keybind text is resolved on your end, depending on your language, keybinds, and installed mods. And when you save your changes, that unformatted text is returned to the server.
Servers exploiting this vulnerability don't wait for you to right a sign or to click save. They just force-open the sign edit screen and instantly close it again. You never actually see the screen open.
As mentioned in the changelog, the fix in Wurst was to completely prevent Minecraft's rich text format from resolving any of Wurst's translations or keybinds. They will simply fail to resolve as if Wurst wasn't installed, not just in signs but anywhere formatted text is used in Minecraft. So if a similar exploit is discovered in books, for example, then Wurst will not be affected by it.
Ideally Mojang would stop signs from leaking all this data in the first place, but this is something that only they can do. If I fixed this leak, the signs of Wurst users would look different than the signs of vanilla Minecraft users, which would again allow servers to detect that Wurst is installed.