From 25605339f563db053f48b56bbfdec08f3c930e7d Mon Sep 17 00:00:00 2001
From: JRoy <10731363+JRoy@users.noreply.github.com>
Date: Sat, 4 Apr 2026 22:04:29 -0700
Subject: [PATCH] Reject Windows reserved filenames in /setwarp

Names like 'con', 'nul', 'aux', etc. cause the server to hang on
Windows when used as warp names since they map to reserved devices.

Fixes #5430
---
 .../earth2me/essentials/commands/Commandsetwarp.java   |  4 ++++
 .../java/com/earth2me/essentials/utils/StringUtil.java | 10 ++++++++++
 2 files changed, 14 insertions(+)

diff --git a/Essentials/src/main/java/com/earth2me/essentials/commands/Commandsetwarp.java b/Essentials/src/main/java/com/earth2me/essentials/commands/Commandsetwarp.java
index f5adff26d03..a8b470a68fe 100644
--- a/Essentials/src/main/java/com/earth2me/essentials/commands/Commandsetwarp.java
+++ b/Essentials/src/main/java/com/earth2me/essentials/commands/Commandsetwarp.java
@@ -25,6 +25,10 @@ public void run(final Server server, final User user, final String commandLabel,
             throw new TranslatableException("invalidWarpName");
         }
 
+        if (StringUtil.isReservedFileName(args[0])) {
+            throw new TranslatableException("invalidWarpName");
+        }
+
         final IWarps warps = ess.getWarps();
         Location warpLoc = null;
 
diff --git a/Essentials/src/main/java/com/earth2me/essentials/utils/StringUtil.java b/Essentials/src/main/java/com/earth2me/essentials/utils/StringUtil.java
index d9d6602d7b1..a3d949b83b5 100644
--- a/Essentials/src/main/java/com/earth2me/essentials/utils/StringUtil.java
+++ b/Essentials/src/main/java/com/earth2me/essentials/utils/StringUtil.java
@@ -18,11 +18,21 @@ public final class StringUtil {
     private StringUtil() {
     }
 
+    private static final Pattern WINDOWS_RESERVED = Pattern.compile("^(con|prn|aux|nul|com[0-9]|lpt[0-9])$");
+
     //Used to clean file names before saving to disk
     public static String sanitizeFileName(final String name) {
         return INVALIDFILECHARS.matcher(name.toLowerCase(Locale.ENGLISH)).replaceAll("_");
     }
 
+    /**
+     * Returns true if the given name is a Windows reserved filename (e.g. CON, NUL, AUX).
+     * Using these as file names on Windows will hang or crash the server.
+     */
+    public static boolean isReservedFileName(final String name) {
+        return WINDOWS_RESERVED.matcher(name.toLowerCase(Locale.ENGLISH)).matches();
+    }
+
     //Used to clean strings/names before saving as filenames/permissions
     public static String safeString(final String string) {
         if (string == null) {