Merge branch 'dev' into fix/gameclients-inputs

Emulator/src/main/java/com/eu/habbo/Emulator.java

@@ -166,6 +166,7 @@ public final class Emulator {
             Emulator.config.register("rcon.rate_limit.timeout_ms", "0");
             Emulator.config.register("rcon.execute_command.denied_permissions", "cmd_shutdown;cmd_give_rank");
             Emulator.config.register("rcon.execute_command.allowed_permissions", "");
+            Emulator.config.register("rcon.max_payload_bytes", "65536");
             registerEarningsSettings();
             String hotelTimezoneId = Emulator.getConfig().getValue("hotel.timezone", java.time.ZoneId.systemDefault().getId());
             System.out.println(startupCard(hotelTimezoneId));

Emulator/src/main/java/com/eu/habbo/habbohotel/catalog/CatalogItem.java

@@ -174,6 +174,14 @@ public class CatalogItem implements ISerialize, Runnable, Comparable<CatalogItem
         return this.offerId;
     }
 
+    public int getSearchOfferId() {
+        if (this.offerId > 0) {
+            return this.offerId;
+        }
+
+        return haveOffer(this) ? this.id : -1;
+    }
+
     public boolean isLimited() {
         return this.limitedStack > 0;
     }

Emulator/src/main/java/com/eu/habbo/habbohotel/catalog/CatalogManager.java

@@ -494,10 +494,11 @@ public class CatalogManager {
                     item = new CatalogItem(set);
                     page.addItem(item);
 
-                    if (item.getOfferId() != -1) {
-                        page.addOfferId(item.getOfferId());
+                    int searchOfferId = item.getSearchOfferId();
+                    if (searchOfferId != -1) {
+                        page.addOfferId(searchOfferId);
 
-                        this.offerDefs.put(item.getOfferId(), item.getId());
+                        this.offerDefs.put(searchOfferId, item.getId());
                     }
                 } else
                     item.update(set);

Emulator/src/main/java/com/eu/habbo/habbohotel/catalog/marketplace/MarketPlace.java

@@ -58,6 +58,10 @@ public class MarketPlace {
     public static void takeBackItem(Habbo habbo, int offerId) {
         MarketPlaceOffer offer = habbo.getInventory().getOffer(offerId);
 
+        if (offer == null) {
+            return;
+        }
+
         if (!Emulator.getPluginManager().fireEvent(new MarketPlaceItemCancelledEvent(offer)).isCancelled()) {
             takeBackItem(habbo, offer);
         }

Emulator/src/main/java/com/eu/habbo/habbohotel/commands/AlertCommand.java

@@ -32,6 +32,11 @@ public class AlertCommand extends Command {
         Habbo habbo = Emulator.getGameEnvironment().getHabboManager().getHabbo(targetUsername);
 
         if (habbo != null) {
+            if (!CommandTargetGuard.canTarget(gameClient.getHabbo(), habbo)) {
+                gameClient.getHabbo().whisper(Emulator.getTexts().getValue("commands.error.cmd_ban.target_rank_higher"), RoomChatMessageBubbles.ALERT);
+                return true;
+            }
+
             habbo.alert(message + "\r\n    -" + gameClient.getHabbo().getHabboInfo().getUsername());
             gameClient.getHabbo().whisper(Emulator.getTexts().getValue("commands.succes.cmd_alert.message_send").replace("%user%", targetUsername), RoomChatMessageBubbles.ALERT);
         } else {

Emulator/src/main/java/com/eu/habbo/habbohotel/commands/BanCommand.java

@@ -60,7 +60,7 @@ public class BanCommand extends Command {
             return true;
         }
 
-        if (target.getRank().getId() >= gameClient.getHabbo().getHabboInfo().getRank().getId()) {
+        if (!CommandTargetGuard.canTarget(gameClient.getHabbo(), target)) {
             gameClient.getHabbo().whisper(Emulator.getTexts().getValue("commands.error.cmd_ban.target_rank_higher"), RoomChatMessageBubbles.ALERT);
             return true;
         }

Emulator/src/main/java/com/eu/habbo/habbohotel/commands/CommandTargetGuard.java

@@ -0,0 +1,46 @@
+package com.eu.habbo.habbohotel.commands;
+
+import com.eu.habbo.Emulator;
+import com.eu.habbo.habbohotel.permissions.Rank;
+import com.eu.habbo.habbohotel.users.Habbo;
+import com.eu.habbo.habbohotel.users.HabboInfo;
+
+final class CommandTargetGuard {
+    private CommandTargetGuard() {
+    }
+
+    static boolean canTarget(Habbo moderator, Habbo target) {
+        return target != null && canTarget(moderator, target.getHabboInfo());
+    }
+
+    static boolean canTarget(Habbo moderator, HabboInfo target) {
+        if (moderator == null || target == null || moderator.getHabboInfo().getId() == target.getId()) {
+            return false;
+        }
+
+        int moderatorRankId = moderator.getHabboInfo().getRank().getId();
+        int targetRankId = target.getRank().getId();
+
+        return targetRankId < moderatorRankId || isCoreRank(moderatorRankId) && targetRankId <= moderatorRankId;
+    }
+
+    static boolean canAssignRank(Habbo moderator, Rank rank) {
+        if (moderator == null || rank == null) {
+            return false;
+        }
+
+        int moderatorRankId = moderator.getHabboInfo().getRank().getId();
+        int targetRankId = rank.getId();
+
+        return targetRankId < moderatorRankId || isCoreRank(moderatorRankId) && targetRankId <= moderatorRankId;
+    }
+
+    private static boolean isCoreRank(int rankId) {
+        int highestRankId = Emulator.getGameEnvironment().getPermissionsManager().getAllRanks().stream()
+                .mapToInt(Rank::getId)
+                .max()
+                .orElse(0);
+
+        return highestRankId > 0 && rankId >= highestRankId;
+    }
+}

Emulator/src/main/java/com/eu/habbo/habbohotel/commands/DisconnectCommand.java

@@ -29,7 +29,7 @@ public class DisconnectCommand extends Command {
             return true;
         }
 
-        if (target.getHabboInfo().getRank().getId() > gameClient.getHabbo().getHabboInfo().getRank().getId()) {
+        if (!CommandTargetGuard.canTarget(gameClient.getHabbo(), target)) {
             gameClient.getHabbo().whisper(Emulator.getTexts().getValue("commands.error.cmd_disconnect.higher_rank"), RoomChatMessageBubbles.ALERT);
             return true;
         }

Emulator/src/main/java/com/eu/habbo/habbohotel/commands/GivePrefixCommand.java

@@ -47,6 +47,11 @@ public class GivePrefixCommand extends Command {
             return true;
         }
 
+        if (!CommandTargetGuard.canTarget(gameClient.getHabbo(), target)) {
+            gameClient.getHabbo().whisper(Emulator.getTexts().getValue("commands.error.cmd_ban.target_rank_higher"), RoomChatMessageBubbles.ALERT);
+            return true;
+        }
+
         UserPrefix prefix = new UserPrefix(target.getHabboInfo().getId(), text, color, icon, effect);
         prefix.run();
         target.getInventory().getPrefixesComponent().addPrefix(prefix);

Emulator/src/main/java/com/eu/habbo/habbohotel/commands/GiveRankCommand.java

@@ -36,7 +36,7 @@ public class GiveRankCommand extends Command {
             }
 
             if (rank != null) {
-                if (rank.getId() > gameClient.getHabbo().getHabboInfo().getRank().getId()) {
+                if (!CommandTargetGuard.canAssignRank(gameClient.getHabbo(), rank)) {
                     gameClient.getHabbo().whisper(Emulator.getTexts().getValue("commands.error.cmd_give_rank.higher").replace("%username%", params[1]).replace("%id%", rank.getName()), RoomChatMessageBubbles.ALERT);
                     return true;
                 }
@@ -44,7 +44,7 @@ public class GiveRankCommand extends Command {
                 HabboInfo habbo = HabboManager.getOfflineHabboInfo(params[1]);
 
                 if (habbo != null) {
-                    if (habbo.getRank().getId() > gameClient.getHabbo().getHabboInfo().getRank().getId()) {
+                    if (!CommandTargetGuard.canTarget(gameClient.getHabbo(), habbo)) {
                         gameClient.getHabbo().whisper(Emulator.getTexts().getValue("commands.error.cmd_give_rank.higher.other").replace("%username%", params[1]).replace("%id%", rank.getName()), RoomChatMessageBubbles.ALERT);
                         return true;
                     }

Emulator/src/main/java/com/eu/habbo/habbohotel/commands/IPBanCommand.java

@@ -47,7 +47,7 @@ public class IPBanCommand extends Command {
                 return true;
             }
 
-            if (habbo.getRank().getId() >= gameClient.getHabbo().getHabboInfo().getRank().getId()) {
+            if (!CommandTargetGuard.canTarget(gameClient.getHabbo(), habbo)) {
                 gameClient.getHabbo().whisper(Emulator.getTexts().getValue("commands.error.cmd_ban.target_rank_higher"), RoomChatMessageBubbles.ALERT);
                 return true;
             }

Emulator/src/main/java/com/eu/habbo/habbohotel/commands/MachineBanCommand.java

@@ -43,7 +43,7 @@ public class MachineBanCommand extends Command {
                 return true;
             }
 
-            if (habbo.getRank().getId() >= gameClient.getHabbo().getHabboInfo().getRank().getId()) {
+            if (!CommandTargetGuard.canTarget(gameClient.getHabbo(), habbo)) {
                 gameClient.getHabbo().whisper(Emulator.getTexts().getValue("commands.error.cmd_ban.target_rank_higher"), RoomChatMessageBubbles.ALERT);
                 return true;
             }

Emulator/src/main/java/com/eu/habbo/habbohotel/commands/MuteCommand.java

@@ -29,6 +29,11 @@ public class MuteCommand extends Command {
                 return true;
             }
 
+            if (!CommandTargetGuard.canTarget(gameClient.getHabbo(), habbo)) {
+                gameClient.getHabbo().whisper(Emulator.getTexts().getValue("commands.error.cmd_ban.target_rank_higher"), RoomChatMessageBubbles.ALERT);
+                return true;
+            }
+
             int duration = Integer.MAX_VALUE;
 
             if (params.length == 3) {

Emulator/src/main/java/com/eu/habbo/habbohotel/commands/RemovePrefixCommand.java

@@ -31,6 +31,11 @@ public class RemovePrefixCommand extends Command {
             return true;
         }
 
+        if (!CommandTargetGuard.canTarget(gameClient.getHabbo(), target)) {
+            gameClient.getHabbo().whisper(Emulator.getTexts().getValue("commands.error.cmd_ban.target_rank_higher"), RoomChatMessageBubbles.ALERT);
+            return true;
+        }
+
         if (prefixIdStr.equalsIgnoreCase("all")) {
             List<UserPrefix> prefixes = target.getInventory().getPrefixesComponent().getPrefixes();
             for (UserPrefix prefix : prefixes) {

Emulator/src/main/java/com/eu/habbo/habbohotel/commands/SuperbanCommand.java

@@ -41,7 +41,7 @@ public class SuperbanCommand extends Command {
                 return true;
             }
 
-            if (habbo.getRank().getId() >= gameClient.getHabbo().getHabboInfo().getRank().getId()) {
+            if (!CommandTargetGuard.canTarget(gameClient.getHabbo(), habbo)) {
                 gameClient.getHabbo().whisper(Emulator.getTexts().getValue("commands.error.cmd_ban.target_rank_higher"), RoomChatMessageBubbles.ALERT);
                 return true;
             }

Emulator/src/main/java/com/eu/habbo/habbohotel/commands/UnmuteCommand.java

@@ -23,6 +23,11 @@ public class UnmuteCommand extends Command {
             gameClient.getHabbo().whisper(Emulator.getTexts().getValue("commands.error.cmd_unmute.not_found").replace("%user%", params[1]), RoomChatMessageBubbles.ALERT);
             return true;
         } else {
+            if (!CommandTargetGuard.canTarget(gameClient.getHabbo(), habbo)) {
+                gameClient.getHabbo().whisper(Emulator.getTexts().getValue("commands.error.cmd_ban.target_rank_higher"), RoomChatMessageBubbles.ALERT);
+                return true;
+            }
+
             if (!habbo.getHabboStats().allowTalk() || (habbo.getHabboInfo().getCurrentRoom() != null && habbo.getHabboInfo().getCurrentRoom().isMuted(habbo))) {
                 if (!habbo.getHabboStats().allowTalk()) {
                     habbo.unMute();

Emulator/src/main/java/com/eu/habbo/habbohotel/guilds/GuildManager.java

@@ -441,7 +441,7 @@ public class GuildManager {
     public int getGuildMembersCount(Guild guild, int page, int levelId, String query) {
         try (Connection connection = Emulator.getDatabase().getDataSource().getConnection(); PreparedStatement statement = connection.prepareStatement("SELECT COUNT(*) FROM guilds_members INNER JOIN users ON guilds_members.user_id = users.id WHERE guilds_members.guild_id = ?  " + (rankQuery(levelId)) + " AND users.username LIKE ? ORDER BY level_id, member_since ASC")) {
             statement.setInt(1, guild.getId());
-            statement.setString(2, "%" + query + "%");
+            statement.setString(2, "%" + com.eu.habbo.util.SqlLikeEscaper.escape(query) + "%");
 
             try (ResultSet set = statement.executeQuery()) {
                 while (set.next()) {

Emulator/src/main/java/com/eu/habbo/habbohotel/rooms/RoomTrade.java

@@ -23,6 +23,7 @@ public class RoomTrade {
     //Configuration. Loaded from database & updated accordingly.
     public static boolean TRADING_ENABLED = true;
     public static boolean TRADING_REQUIRES_PERK = true;
+    public static final int MAX_OFFERED_ITEMS = 100;
 
     private final List<RoomTradeUser> users;
     private final Room room;
@@ -58,7 +59,7 @@ public class RoomTrade {
     public synchronized void offerItem(Habbo habbo, HabboItem item) {
         RoomTradeUser user = this.getRoomTradeUserForHabbo(habbo);
 
-        if (user == null || item == null || user.getItems().contains(item))
+        if (user == null || item == null || user.getItems().contains(item) || user.getItems().size() >= MAX_OFFERED_ITEMS)
             return;
 
         habbo.getInventory().getItemsComponent().removeHabboItem(item);
@@ -75,6 +76,9 @@ public class RoomTrade {
             return;
 
         for (HabboItem item : items) {
+            if (user.getItems().size() >= MAX_OFFERED_ITEMS)
+                break;
+
             if (!user.getItems().contains(item)) {
                 habbo.getInventory().getItemsComponent().removeHabboItem(item);
                 user.getItems().add(item);

Emulator/src/main/java/com/eu/habbo/messages/incoming/catalog/CatalogSearchedItemEvent.java

@@ -12,10 +12,15 @@ public class CatalogSearchedItemEvent extends MessageHandler {
     public void handle() throws Exception {
         int offerId = this.packet.readInt();
 
-        int pageId = Emulator.getGameEnvironment().getCatalogManager().offerDefs.get(offerId);
+        int catalogItemId = Emulator.getGameEnvironment().getCatalogManager().offerDefs.get(offerId);
 
-        if (pageId != 0) {
-            CatalogPage page = Emulator.getGameEnvironment().getCatalogManager().getCatalogPage(Emulator.getGameEnvironment().getCatalogManager().getCatalogItem(pageId).getPageId());
+        if (catalogItemId != 0) {
+            CatalogItem requestedItem = Emulator.getGameEnvironment().getCatalogManager().getCatalogItem(catalogItemId);
+            if (requestedItem == null) {
+                return;
+            }
+
+            CatalogPage page = Emulator.getGameEnvironment().getCatalogManager().getCatalogPage(requestedItem.getPageId());
 
             if (page != null) {
                 TIntObjectIterator<CatalogItem> iterator = page.getCatalogItems().iterator();
@@ -25,7 +30,7 @@ public class CatalogSearchedItemEvent extends MessageHandler {
 
                     CatalogItem item = iterator.value();
 
-                    if (item.getOfferId() == offerId) {
+                    if (item.getSearchOfferId() == offerId) {
                         this.client.sendResponse(new CatalogSearchResultComposer(item));
                         return;
                     }

Emulator/src/main/java/com/eu/habbo/messages/incoming/catalog/marketplace/BuyItemEvent.java

@@ -13,6 +13,10 @@ public class BuyItemEvent extends MessageHandler {
     public void handle() throws Exception {
         int offerId = this.packet.readInt();
 
+        if (!MarketplaceInputGuard.isPositiveId(offerId)) {
+            return;
+        }
+
         MarketPlace.buyItem(offerId, this.client);
     }
 }

Emulator/src/main/java/com/eu/habbo/messages/incoming/catalog/marketplace/MarketplaceInputGuard.java

@@ -0,0 +1,47 @@
+package com.eu.habbo.messages.incoming.catalog.marketplace;
+
+import com.eu.habbo.habbohotel.catalog.marketplace.MarketPlace;
+
+final class MarketplaceInputGuard {
+    static final int MAX_SEARCH_LENGTH = 30;
+    static final int DEFAULT_SORT = 1;
+    static final int MIN_SORT = 1;
+    static final int MAX_SORT = 6;
+
+    private MarketplaceInputGuard() {
+    }
+
+    static boolean isPositiveId(int id) {
+        return id > 0;
+    }
+
+    static String normalizeSearch(String query) {
+        if (query == null) {
+            return "";
+        }
+
+        String normalized = query.trim();
+        return normalized.length() > MAX_SEARCH_LENGTH ? normalized.substring(0, MAX_SEARCH_LENGTH) : normalized;
+    }
+
+    static int normalizeSort(int sort) {
+        return sort >= MIN_SORT && sort <= MAX_SORT ? sort : DEFAULT_SORT;
+    }
+
+    static int normalizeMinPrice(int minPrice) {
+        if (minPrice == -1) {
+            return -1;
+        }
+
+        return Math.max(0, Math.min(minPrice, MarketPlace.MAXIMUM_LISTING_PRICE));
+    }
+
+    static int normalizeMaxPrice(int maxPrice, int minPrice) {
+        if (maxPrice == -1) {
+            return -1;
+        }
+
+        int normalized = Math.max(0, Math.min(maxPrice, MarketPlace.MAXIMUM_LISTING_PRICE));
+        return minPrice > 0 && normalized > 0 && normalized < minPrice ? minPrice : normalized;
+    }
+}

Emulator/src/main/java/com/eu/habbo/messages/incoming/catalog/marketplace/RequestItemInfoEvent.java

@@ -9,6 +9,10 @@ public class RequestItemInfoEvent extends MessageHandler {
         this.packet.readInt();
         int id = this.packet.readInt();
 
+        if (!MarketplaceInputGuard.isPositiveId(id)) {
+            return;
+        }
+
         this.client.sendResponse(new MarketplaceItemInfoComposer(id));
     }
 }

Emulator/src/main/java/com/eu/habbo/messages/incoming/catalog/marketplace/RequestOffersEvent.java

@@ -20,14 +20,10 @@ public class RequestOffersEvent extends MessageHandler {
 
     @Override
     public void handle() throws Exception {
-        int min = this.packet.readInt();
-        int max = this.packet.readInt();
-        String query = this.packet.readString();
-        int type = this.packet.readInt();
-
-        if (query.length() > 30) {
-            query = query.substring(0, 30);
-        }
+        int min = MarketplaceInputGuard.normalizeMinPrice(this.packet.readInt());
+        int max = MarketplaceInputGuard.normalizeMaxPrice(this.packet.readInt(), min);
+        String query = MarketplaceInputGuard.normalizeSearch(this.packet.readString());
+        int type = MarketplaceInputGuard.normalizeSort(this.packet.readInt());
 
 
         boolean tryCache = min == -1 && max == -1 && query.isEmpty();

Emulator/src/main/java/com/eu/habbo/messages/incoming/catalog/marketplace/SellItemEvent.java

@@ -29,6 +29,7 @@ public class SellItemEvent extends MessageHandler {
         final int furniType = this.packet.readInt(); // 1 = FLOOR_TYPE, 2 = WALL_TYPE
         final int itemId = this.packet.readInt();
 
+        if (!MarketplaceInputGuard.isPositiveId(itemId)) return;
         if (furniType != 1 && furniType != 2) return;
 
         HabboItem item = this.client.getHabbo().getInventory().getItemsComponent().getHabboItem(itemId);

Emulator/src/main/java/com/eu/habbo/messages/incoming/catalog/marketplace/TakeBackItemEvent.java

@@ -12,6 +12,11 @@ public class TakeBackItemEvent extends MessageHandler {
     @Override
     public void handle() throws Exception {
         int offerId = this.packet.readInt();
+
+        if (!MarketplaceInputGuard.isPositiveId(offerId)) {
+            return;
+        }
+
         MarketPlace.takeBackItem(this.client.getHabbo(), offerId);
     }
 }

Emulator/src/main/java/com/eu/habbo/messages/incoming/friends/AcceptFriendRequestEvent.java

@@ -25,14 +25,16 @@ public class AcceptFriendRequestEvent extends MessageHandler {
 
     @Override
     public void handle() throws Exception {
-        int count = Math.min(this.packet.readInt(), 100);
+        int count = this.packet.readInt();
+        if (count <= 0 || count > 100) return;
+
         int userId;
 
         for (int i = 0; i < count; i++) {
             userId = this.packet.readInt();
 
-            if (userId == 0)
-                return;
+            if (userId <= 0)
+                continue;
 
             if (this.client.getHabbo().getMessenger().getFriends().containsKey(userId)) {
                 this.client.getHabbo().getMessenger().deleteFriendRequests(userId, this.client.getHabbo().getHabboInfo().getId());

Emulator/src/main/java/com/eu/habbo/messages/incoming/friends/ChangeRelationEvent.java

@@ -1,5 +1,6 @@
 package com.eu.habbo.messages.incoming.friends;
 
+import com.eu.habbo.Emulator;
 import com.eu.habbo.habbohotel.messenger.MessengerBuddy;
 import com.eu.habbo.messages.incoming.MessageHandler;
 import com.eu.habbo.messages.outgoing.friends.UpdateFriendComposer;
@@ -12,12 +13,16 @@ public class ChangeRelationEvent extends MessageHandler {
         int relationId = this.packet.readInt();
 
         MessengerBuddy buddy = this.client.getHabbo().getMessenger().getFriends().get(userId);
-        if (buddy != null && relationId >= 0 && relationId <= 3) {
+        if (buddy != null && FriendInputGuard.isValidRelation(relationId)) {
             UserRelationShipEvent event = new UserRelationShipEvent(this.client.getHabbo(), buddy, relationId);
-            if (!event.isCancelled()) {
+            if (Emulator.getPluginManager().fireEvent(event).isCancelled())
+                return;
+
+            if (!FriendInputGuard.isValidRelation(event.relationShip))
+                return;
+
             buddy.setRelation(event.relationShip);
             this.client.sendResponse(new UpdateFriendComposer(this.client.getHabbo(), buddy, 0));
         }
     }
-    }
 }

Emulator/src/main/java/com/eu/habbo/messages/incoming/friends/DeclineFriendRequestEvent.java

@@ -3,6 +3,8 @@ package com.eu.habbo.messages.incoming.friends;
 import com.eu.habbo.messages.incoming.MessageHandler;
 
 public class DeclineFriendRequestEvent extends MessageHandler {
+    private static final int MAX_BATCH_SIZE = 100;
+
     @Override
     public void handle() throws Exception {
         boolean all = this.packet.readBoolean();
@@ -11,6 +13,7 @@ public class DeclineFriendRequestEvent extends MessageHandler {
             this.client.getHabbo().getMessenger().deleteAllFriendRequests(this.client.getHabbo().getHabboInfo().getId());
         } else {
             int count = this.packet.readInt();
+            if (count <= 0 || count > MAX_BATCH_SIZE) return;
 
             for (int i = 0; i < count; i++) {
                 this.client.getHabbo().getMessenger().deleteFriendRequests(this.packet.readInt(), this.client.getHabbo().getHabboInfo().getId());

Emulator/src/main/java/com/eu/habbo/messages/incoming/friends/FriendInputGuard.java

@@ -0,0 +1,31 @@
+package com.eu.habbo.messages.incoming.friends;
+
+final class FriendInputGuard {
+    static final int MAX_USERNAME_LENGTH = 15;
+    static final int MAX_MESSAGE_LENGTH = 255;
+    static final int MAX_RELATION_ID = 3;
+
+    private FriendInputGuard() {
+    }
+
+    static String normalizeUsername(String username) {
+        return username == null ? "" : username.trim();
+    }
+
+    static boolean isValidUsername(String username) {
+        return username != null && !username.isBlank() && username.length() <= MAX_USERNAME_LENGTH;
+    }
+
+    static String normalizeMessage(String message) {
+        if (message == null) {
+            return "";
+        }
+
+        String normalized = message.trim();
+        return normalized.length() > MAX_MESSAGE_LENGTH ? normalized.substring(0, MAX_MESSAGE_LENGTH) : normalized;
+    }
+
+    static boolean isValidRelation(int relationId) {
+        return relationId >= 0 && relationId <= MAX_RELATION_ID;
+    }
+}

Emulator/src/main/java/com/eu/habbo/messages/incoming/friends/FriendPrivateMessageEvent.java

@@ -9,7 +9,11 @@ public class FriendPrivateMessageEvent extends MessageHandler {
     @Override
     public void handle() throws Exception {
         int userId = this.packet.readInt();
-        String message = this.packet.readString();
+        String message = FriendInputGuard.normalizeMessage(this.packet.readString());
+
+        if (message.isEmpty()) {
+            return;
+        }
 
         if (!this.client.getHabbo().getHabboStats().allowTalk()) {
             return;
@@ -25,8 +29,6 @@ public class FriendPrivateMessageEvent extends MessageHandler {
         if (buddy == null)
             return;
 
-        if (message.length() > 255) message = message.substring(0, 255);
-
         UserFriendChatEvent event = new UserFriendChatEvent(this.client.getHabbo(), buddy, message);
         if (Emulator.getPluginManager().fireEvent(event).isCancelled())
             return;

Emulator/src/main/java/com/eu/habbo/messages/incoming/friends/FriendRequestEvent.java

@@ -26,9 +26,9 @@ public class FriendRequestEvent extends MessageHandler {
 
     @Override
     public void handle() throws Exception {
-        String username = this.packet.readString();
+        String username = FriendInputGuard.normalizeUsername(this.packet.readString());
 
-        if (this.client == null || username == null || username.isEmpty())
+        if (this.client == null || !FriendInputGuard.isValidUsername(username))
             return;
 
         // TargetHabbo can be null if the Habbo is not online or when the Habbo doesn't exist
@@ -62,6 +62,12 @@ public class FriendRequestEvent extends MessageHandler {
         if (targetId == this.client.getHabbo().getHabboInfo().getId())
             return;
 
+        if (this.client.getHabbo().getMessenger().getFriends().containsKey(targetId))
+            return;
+
+        if (Messenger.friendRequested(targetId, this.client.getHabbo().getHabboInfo().getId()) || Messenger.friendRequested(this.client.getHabbo().getHabboInfo().getId(), targetId))
+            return;
+
         // Target Habbo exists
         // Check if Habbo is accepting friend requests
         if (targetBlocksFriendRequests) {

Emulator/src/main/java/com/eu/habbo/messages/incoming/friends/InviteFriendsEvent.java

@@ -23,9 +23,14 @@ public class InviteFriendsEvent extends MessageHandler {
                 userIds[i] = this.packet.readInt();
             }
 
-            String message = this.packet.readString();
+            String message = FriendInputGuard.normalizeMessage(this.packet.readString());
+
+            if (message.isEmpty()) {
+                return;
+            }
 
             message = Emulator.getGameEnvironment().getWordFilter().filter(message, this.client.getHabbo());
+            message = FriendInputGuard.normalizeMessage(message);
 
             for (int i : userIds) {
                 if (i == 0)

Emulator/src/main/java/com/eu/habbo/messages/incoming/friends/RemoveFriendEvent.java

@@ -8,6 +8,7 @@ import com.eu.habbo.messages.outgoing.friends.RemoveFriendComposer;
 import gnu.trove.list.array.TIntArrayList;
 
 public class RemoveFriendEvent extends MessageHandler {
+    private static final int MAX_BATCH_SIZE = 100;
 
     private final TIntArrayList removedFriends;
 
@@ -18,8 +19,12 @@ public class RemoveFriendEvent extends MessageHandler {
     @Override
     public void handle() throws Exception {
         int count = this.packet.readInt();
+        if (count <= 0 || count > MAX_BATCH_SIZE) return;
+
         for (int i = 0; i < count; i++) {
             int habboId = this.packet.readInt();
+            if (habboId <= 0) continue;
+
             this.removedFriends.add(habboId);
 
             Messenger.unfriend(this.client.getHabbo().getHabboInfo().getId(), habboId);

Emulator/src/main/java/com/eu/habbo/messages/incoming/guilds/GuildChangeColorsEvent.java

@@ -21,12 +21,21 @@ public class GuildChangeColorsEvent extends MessageHandler {
 
         if (guild != null) {
             if (guild.getOwnerId() == this.client.getHabbo().getHabboInfo().getId() || this.client.getHabbo().hasPermission(Permission.ACC_GUILD_ADMIN)) {
-                GuildChangedColorsEvent colorsEvent = new GuildChangedColorsEvent(guild, this.packet.readInt(), this.packet.readInt());
+                int colorOne = this.packet.readInt();
+                int colorTwo = this.packet.readInt();
+
+                if (!Emulator.getGameEnvironment().getGuildManager().symbolColor(colorOne) || !Emulator.getGameEnvironment().getGuildManager().backgroundColor(colorTwo))
+                    return;
+
+                GuildChangedColorsEvent colorsEvent = new GuildChangedColorsEvent(guild, colorOne, colorTwo);
                 Emulator.getPluginManager().fireEvent(colorsEvent);
 
                 if (colorsEvent.isCancelled())
                     return;
 
+                if (!Emulator.getGameEnvironment().getGuildManager().symbolColor(colorsEvent.colorOne) || !Emulator.getGameEnvironment().getGuildManager().backgroundColor(colorsEvent.colorTwo))
+                    return;
+
                 if (guild.getColorOne() != colorsEvent.colorOne || guild.getColorTwo() != colorsEvent.colorTwo) {
                     guild.setColorOne(colorsEvent.colorOne);
                     guild.setColorTwo(colorsEvent.colorTwo);

Emulator/src/main/java/com/eu/habbo/messages/incoming/guilds/GuildChangeNameDescEvent.java

@@ -23,6 +23,10 @@ public class GuildChangeNameDescEvent extends MessageHandler {
             if (guild.getOwnerId() == this.client.getHabbo().getHabboInfo().getId() || this.client.getHabbo().hasPermission(Permission.ACC_GUILD_ADMIN)) {
                 String newName = Emulator.getGameEnvironment().getWordFilter().filter(this.packet.readString(), this.client.getHabbo());
                 String newDesc = Emulator.getGameEnvironment().getWordFilter().filter(this.packet.readString(), this.client.getHabbo());
+
+                if (!GuildInputLimits.isValidGuildName(newName) || !GuildInputLimits.isValidGuildDescription(newDesc))
+                    return;
+
                 GuildChangedNameEvent nameEvent = new GuildChangedNameEvent(guild, newName, newDesc);
                 Emulator.getPluginManager().fireEvent(nameEvent);
 
@@ -32,7 +36,7 @@ public class GuildChangeNameDescEvent extends MessageHandler {
                 if (guild.getName().equals(nameEvent.name) && guild.getDescription().equals(nameEvent.description))
                     return;
 
-                if(nameEvent.name.length() > 29 || nameEvent.description.length() > 254)
+                if (!GuildInputLimits.isValidGuildName(nameEvent.name) || !GuildInputLimits.isValidGuildDescription(nameEvent.description))
                     return;
 
                 guild.setName(nameEvent.name);

Emulator/src/main/java/com/eu/habbo/messages/incoming/guilds/GuildChangeSettingsEvent.java

@@ -40,12 +40,20 @@ public class GuildChangeSettingsEvent extends MessageHandler {
 
         if (guild != null) {
             if (guild.getOwnerId() == this.client.getHabbo().getHabboInfo().getId() || this.client.getHabbo().hasPermission(Permission.ACC_GUILD_ADMIN)) {
-                GuildChangedSettingsEvent settingsEvent = new GuildChangedSettingsEvent(guild, this.packet.readInt(), this.packet.readInt() == 0);
+                int state = this.packet.readInt();
+
+                if (state < 0 || state >= GuildState.values().length)
+                    return;
+
+                GuildChangedSettingsEvent settingsEvent = new GuildChangedSettingsEvent(guild, state, this.packet.readInt() == 0);
                 Emulator.getPluginManager().fireEvent(settingsEvent);
 
                 if (settingsEvent.isCancelled())
                     return;
 
+                if (settingsEvent.state < 0 || settingsEvent.state >= GuildState.values().length)
+                    return;
+
                 guild.setState(GuildState.valueOf(settingsEvent.state));
                 guild.setRights(settingsEvent.rights);
 

Emulator/src/main/java/com/eu/habbo/messages/incoming/guilds/GuildInputLimits.java

@@ -0,0 +1,17 @@
+package com.eu.habbo.messages.incoming.guilds;
+
+final class GuildInputLimits {
+    static final int MAX_GUILD_NAME_LENGTH = 29;
+    static final int MAX_GUILD_DESCRIPTION_LENGTH = 254;
+
+    private GuildInputLimits() {
+    }
+
+    static boolean isValidGuildName(String name) {
+        return name != null && !name.isBlank() && name.length() <= MAX_GUILD_NAME_LENGTH;
+    }
+
+    static boolean isValidGuildDescription(String description) {
+        return description != null && description.length() <= MAX_GUILD_DESCRIPTION_LENGTH;
+    }
+}

Emulator/src/main/java/com/eu/habbo/messages/incoming/guilds/RequestGuildBuyEvent.java

@@ -31,11 +31,11 @@ public class RequestGuildBuyEvent extends MessageHandler {
         final String name = Emulator.getGameEnvironment().getWordFilter().filter(this.packet.readString(), this.client.getHabbo());
         final String description = Emulator.getGameEnvironment().getWordFilter().filter(this.packet.readString(), this.client.getHabbo());
 
-        if (name.length() == 0 || name.length() > 29) {
+        if (!GuildInputLimits.isValidGuildName(name)) {
             this.client.sendResponse(new GuildEditFailComposer(GuildEditFailComposer.INVALID_GUILD_NAME));
             return;
         }
-        if (description.length() > 254) {
+        if (!GuildInputLimits.isValidGuildDescription(description)) {
             return;
         }
 
@@ -68,6 +68,11 @@ public class RequestGuildBuyEvent extends MessageHandler {
         int colorOne = this.packet.readInt();
         int colorTwo = this.packet.readInt();
 
+        if (!Emulator.getGameEnvironment().getGuildManager().symbolColor(colorOne) || !Emulator.getGameEnvironment().getGuildManager().backgroundColor(colorTwo)) {
+            this.client.sendResponse(new GuildEditFailComposer(GuildEditFailComposer.INVALID_GUILD_NAME));
+            return;
+        }
+
         int count = this.packet.readInt();
 
         String badge = GuildBadgeBuilder.readBadge(this.packet, count);

Emulator/src/main/java/com/eu/habbo/messages/incoming/guilds/RequestGuildMembersEvent.java

@@ -9,6 +9,10 @@ import com.eu.habbo.messages.incoming.MessageHandler;
 import com.eu.habbo.messages.outgoing.guilds.GuildMembersComposer;
 
 public class RequestGuildMembersEvent extends MessageHandler {
+    private static final int MAX_PAGE_ID = 1000;
+    private static final int MAX_QUERY_LENGTH = 32;
+    private static final int MAX_LEVEL_ID = 2;
+
     @Override
     public int getRatelimit() {
         return 500;
@@ -20,6 +24,9 @@ public class RequestGuildMembersEvent extends MessageHandler {
         int pageId = this.packet.readInt();
         String query = this.packet.readString();
         int levelId = this.packet.readInt();
+        if (pageId < 0 || pageId > MAX_PAGE_ID || levelId < 0 || levelId > MAX_LEVEL_ID || query == null || query.length() > MAX_QUERY_LENGTH) {
+            return;
+        }
 
         Guild g = Emulator.getGameEnvironment().getGuildManager().getGuild(groupId);
 

Emulator/src/main/java/com/eu/habbo/messages/incoming/guilds/forums/GuildForumDataEvent.java

@@ -8,6 +8,7 @@ import com.eu.habbo.messages.incoming.MessageHandler;
 import com.eu.habbo.messages.outgoing.generic.alerts.BubbleAlertComposer;
 import com.eu.habbo.messages.outgoing.generic.alerts.BubbleAlertKeys;
 import com.eu.habbo.messages.outgoing.guilds.forums.GuildForumDataComposer;
+import com.eu.habbo.messages.outgoing.handshake.ConnectionErrorComposer;
 
 public class GuildForumDataEvent extends MessageHandler {
     @Override
@@ -19,6 +20,11 @@ public class GuildForumDataEvent extends MessageHandler {
     public void handle() throws Exception {
         int guildId = packet.readInt();
 
+        if (!GuildForumInputGuard.isPositiveId(guildId)) {
+            this.client.sendResponse(new ConnectionErrorComposer(400));
+            return;
+        }
+
         Guild guild = Emulator.getGameEnvironment().getGuildManager().getGuild(guildId);
 
         if (guild == null) return;

Emulator/src/main/java/com/eu/habbo/messages/incoming/guilds/forums/GuildForumInputGuard.java

@@ -2,6 +2,7 @@ package com.eu.habbo.messages.incoming.guilds.forums;
 
 final class GuildForumInputGuard {
     static final int MAX_PAGE_LIMIT = 50;
+    static final int MAX_THREAD_INDEX = 1000;
     static final int MAX_MARK_READ_BATCH = 50;
 
     private GuildForumInputGuard() {
@@ -19,6 +20,10 @@ final class GuildForumInputGuard {
         return index >= 0 && limit > 0 && limit <= MAX_PAGE_LIMIT;
     }
 
+    static boolean isValidThreadIndex(int index) {
+        return index >= 0 && index <= MAX_THREAD_INDEX;
+    }
+
     static boolean isValidMarkReadBatch(int count) {
         return count > 0 && count <= MAX_MARK_READ_BATCH;
     }

Emulator/src/main/java/com/eu/habbo/messages/incoming/guilds/forums/GuildForumMarkAsReadEvent.java

@@ -1,6 +1,9 @@
 package com.eu.habbo.messages.incoming.guilds.forums;
 
 import com.eu.habbo.Emulator;
+import com.eu.habbo.habbohotel.guilds.Guild;
+import com.eu.habbo.habbohotel.guilds.GuildMember;
+import com.eu.habbo.habbohotel.permissions.Permission;
 import com.eu.habbo.messages.incoming.MessageHandler;
 import com.eu.habbo.messages.outgoing.guilds.forums.GuildForumDataComposer;
 import org.slf4j.Logger;
@@ -37,6 +40,17 @@ public class GuildForumMarkAsReadEvent extends MessageHandler {
                 continue;
             }
 
+            Guild guild = Emulator.getGameEnvironment().getGuildManager().getGuild(guildId);
+            if (guild == null || !guild.hasForum()) {
+                continue;
+            }
+
+            GuildMember member = Emulator.getGameEnvironment().getGuildManager().getGuildMember(guildId, userId);
+            boolean staff = this.client.getHabbo().hasPermission(Permission.ACC_MODTOOL_TICKET_Q);
+            if (!guild.canHabboReadForum(userId, member, staff)) {
+                continue;
+            }
+
             try (Connection connection = Emulator.getDatabase().getDataSource().getConnection(); PreparedStatement statement = connection.prepareStatement(
                     "INSERT INTO `guild_forum_views` (`user_id`, `guild_id`, `timestamp`) VALUES (?, ?, ?) " +
                             "ON DUPLICATE KEY UPDATE `timestamp` = ?"

Emulator/src/main/java/com/eu/habbo/messages/incoming/guilds/forums/GuildForumThreadsEvent.java

@@ -22,7 +22,7 @@ public class GuildForumThreadsEvent extends MessageHandler {
         int guildId = packet.readInt();
         int index = packet.readInt();
 
-        if (!GuildForumInputGuard.isPositiveId(guildId) || index < 0) {
+        if (!GuildForumInputGuard.isPositiveId(guildId) || !GuildForumInputGuard.isValidThreadIndex(index)) {
             this.client.sendResponse(new ConnectionErrorComposer(400));
             return;
         }

Emulator/src/main/java/com/eu/habbo/messages/incoming/handshake/SecureLoginEvent.java

@@ -50,6 +50,7 @@ import java.util.Date;
 @NoAuthMessage
 public class SecureLoginEvent extends MessageHandler {
     private static final Logger LOGGER = LoggerFactory.getLogger(SecureLoginEvent.class);
+    private static final int MAX_SSO_TICKET_LENGTH = 128;
 
     @Override
     public int getRatelimit() {
@@ -80,9 +81,9 @@ public class SecureLoginEvent extends MessageHandler {
             return;
         }
 
-        if (Emulator.getPluginManager().fireEvent(new SSOAuthenticationEvent(sso)).isCancelled()) {
+        if (sso.isEmpty() || sso.length() > MAX_SSO_TICKET_LENGTH) {
             Emulator.getGameServer().getGameClientManager().disposeClient(this.client);
-            LOGGER.info("SSO Authentication is cancelled by a plugin. Closed connection...");
+            LOGGER.debug("Client is trying to connect with missing or invalid SSO ticket! Closed connection...");
             return;
         }
 

Emulator/src/main/java/com/eu/habbo/messages/incoming/modtool/ModToolAlertEvent.java

@@ -14,7 +14,7 @@ public class ModToolAlertEvent extends MessageHandler {
             int userId = this.packet.readInt();
             String message = ModToolInputGuard.normalize(this.packet.readString());
 
-            if (!ModToolInputGuard.isSafeMessage(message)) {
+            if (!ModToolTicketGuard.isPositiveId(userId) || !ModToolInputGuard.isSafeMessage(message)) {
                 return;
             }
 

Emulator/src/main/java/com/eu/habbo/messages/incoming/modtool/ModToolChangeRoomSettingsEvent.java

@@ -10,7 +10,13 @@ public class ModToolChangeRoomSettingsEvent extends MessageHandler {
     @Override
     public void handle() throws Exception {
         if (this.client.getHabbo().hasPermission(Permission.ACC_SUPPORTTOOL)) {
-            Room room = Emulator.getGameEnvironment().getRoomManager().getRoom(this.packet.readInt());
+            int roomId = this.packet.readInt();
+
+            if (!ModToolTicketGuard.isPositiveId(roomId)) {
+                return;
+            }
+
+            Room room = Emulator.getGameEnvironment().getRoomManager().getRoom(roomId);
 
             if (room != null) {
                 final boolean lockDoor = this.packet.readInt() == 1;

Emulator/src/main/java/com/eu/habbo/messages/incoming/modtool/ModToolIssueDefaultSanctionEvent.java

@@ -19,6 +19,10 @@ public class ModToolIssueDefaultSanctionEvent extends MessageHandler {
             this.packet.readInt();
             int category = this.packet.readInt();
 
+            if (!ModToolTicketGuard.isPositiveId(issueId) || !ModToolTicketGuard.isPositiveId(category)) {
+                return;
+            }
+
             ModToolIssue issue = Emulator.getGameEnvironment().getModToolManager().getTicket(issueId);
 
             if (issue == null) {

Emulator/src/main/java/com/eu/habbo/messages/incoming/modtool/ModToolKickEvent.java

@@ -21,7 +21,7 @@ public class ModToolKickEvent extends MessageHandler {
         int userId = this.packet.readInt();
         String message = ModToolInputGuard.normalize(this.packet.readString());
 
-        if (!ModToolInputGuard.isSafeMessage(message)) {
+        if (!ModToolTicketGuard.isPositiveId(userId) || !ModToolInputGuard.isSafeMessage(message)) {
             return;
         }
 

Emulator/src/main/java/com/eu/habbo/messages/incoming/modtool/ModToolRequestRoomInfoEvent.java

@@ -13,6 +13,10 @@ public class ModToolRequestRoomInfoEvent extends MessageHandler {
         if (this.client.getHabbo().hasPermission(Permission.ACC_SUPPORTTOOL)) {
             int roomId = this.packet.readInt();
 
+            if (!ModToolTicketGuard.isPositiveId(roomId)) {
+                return;
+            }
+
             Room room = Emulator.getGameEnvironment().getRoomManager().getRoom(roomId);
 
             if (room != null) {

Emulator/src/main/java/com/eu/habbo/messages/incoming/modtool/ModToolRequestRoomVisitsEvent.java

@@ -12,6 +12,10 @@ public class ModToolRequestRoomVisitsEvent extends MessageHandler {
         if (this.client.getHabbo().hasPermission(Permission.ACC_SUPPORTTOOL)) {
             int userId = this.packet.readInt();
 
+            if (!ModToolTicketGuard.isPositiveId(userId)) {
+                return;
+            }
+
             HabboInfo habboInfo = Emulator.getGameEnvironment().getHabboManager().getHabboInfo(userId);
 
             if (habboInfo != null) {

Emulator/src/main/java/com/eu/habbo/messages/incoming/modtool/ModToolSanctionAlertEvent.java

@@ -24,7 +24,7 @@ public class ModToolSanctionAlertEvent extends MessageHandler {
         String message = ModToolInputGuard.normalize(this.packet.readString());
         int cfhTopic = this.packet.readInt();
 
-        if (!ModToolInputGuard.isSafeMessage(message)) {
+        if (!ModToolTicketGuard.isPositiveId(userId) || !ModToolTicketGuard.isPositiveId(cfhTopic) || !ModToolInputGuard.isSafeMessage(message)) {
             return;
         }
 

Emulator/src/main/java/com/eu/habbo/messages/incoming/modtool/ModToolSanctionBanEvent.java

@@ -37,7 +37,7 @@ public class ModToolSanctionBanEvent extends MessageHandler {
 
         int duration = 0;
 
-        if (!ModToolInputGuard.isSafeMessage(message)) {
+        if (!ModToolTicketGuard.isPositiveId(userId) || !ModToolTicketGuard.isPositiveId(cfhTopic) || !ModToolInputGuard.isSafeMessage(message)) {
             return;
         }
 

Emulator/src/main/java/com/eu/habbo/messages/incoming/modtool/ModToolSanctionMuteEvent.java

@@ -26,7 +26,7 @@ public class ModToolSanctionMuteEvent extends MessageHandler {
         String message = ModToolInputGuard.normalize(this.packet.readString());
         int cfhTopic = this.packet.readInt();
 
-        if (!ModToolInputGuard.isSafeMessage(message)) {
+        if (!ModToolTicketGuard.isPositiveId(userId) || !ModToolTicketGuard.isPositiveId(cfhTopic) || !ModToolInputGuard.isSafeMessage(message)) {
             return;
         }
 

Emulator/src/main/java/com/eu/habbo/messages/incoming/modtool/ModToolSanctionTradeLockEvent.java

@@ -25,7 +25,7 @@ public class ModToolSanctionTradeLockEvent extends MessageHandler {
         int duration = this.packet.readInt();
         int cfhTopic = this.packet.readInt();
 
-        if (!ModToolInputGuard.isSafeMessage(message)) {
+        if (!ModToolTicketGuard.isPositiveId(userId) || !ModToolTicketGuard.isPositiveId(cfhTopic) || !ModToolInputGuard.isSafeMessage(message)) {
             return;
         }
 

Emulator/src/main/java/com/eu/habbo/messages/incoming/modtool/ModToolWarnEvent.java

@@ -19,7 +19,7 @@ public class ModToolWarnEvent extends MessageHandler {
             int userId = this.packet.readInt();
             String message = ModToolInputGuard.normalize(this.packet.readString());
 
-            if (!ModToolInputGuard.isSafeMessage(message)) {
+            if (!ModToolTicketGuard.isPositiveId(userId) || !ModToolInputGuard.isSafeMessage(message)) {
                 return;
             }
 

Emulator/src/main/java/com/eu/habbo/messages/incoming/navigator/AddSavedSearchEvent.java

@@ -14,11 +14,8 @@ public class AddSavedSearchEvent extends MessageHandler {
 
     @Override
     public void handle() throws Exception {
-        String searchCode = this.packet.readString();
-        String filter = this.packet.readString();
-
-        if (searchCode.length() > 255) searchCode = searchCode.substring(0, 255);
-        if (filter.length() > 255) filter = filter.substring(0, 255);
+        String searchCode = NavigatorInputGuard.normalizeSavedSearchValue(this.packet.readString());
+        String filter = NavigatorInputGuard.normalizeSavedSearchValue(this.packet.readString());
 
         if (this.client.getHabbo().getHabboInfo().getSavedSearches().size() >= MAX_SAVED_SEARCHES) {
             this.client.sendResponse(new NewNavigatorSavedSearchesComposer(this.client.getHabbo().getHabboInfo().getSavedSearches()));

Emulator/src/main/java/com/eu/habbo/messages/incoming/navigator/NavigatorInputGuard.java

@@ -0,0 +1,26 @@
+package com.eu.habbo.messages.incoming.navigator;
+
+final class NavigatorInputGuard {
+    static final int MAX_SEARCH_LENGTH = 64;
+    static final int MAX_SAVED_SEARCH_LENGTH = 255;
+
+    private NavigatorInputGuard() {
+    }
+
+    static String normalizeSearch(String value) {
+        return normalize(value, MAX_SEARCH_LENGTH);
+    }
+
+    static String normalizeSavedSearchValue(String value) {
+        return normalize(value, MAX_SAVED_SEARCH_LENGTH);
+    }
+
+    private static String normalize(String value, int maxLength) {
+        if (value == null) {
+            return "";
+        }
+
+        String normalized = value.trim();
+        return normalized.length() > maxLength ? normalized.substring(0, maxLength) : normalized;
+    }
+}

Emulator/src/main/java/com/eu/habbo/messages/incoming/navigator/SearchRoomsByTagEvent.java

@@ -7,7 +7,7 @@ import com.eu.habbo.messages.outgoing.navigator.PrivateRoomsComposer;
 public class SearchRoomsByTagEvent extends MessageHandler {
     @Override
     public void handle() throws Exception {
-        String tag = this.packet.readString();
+        String tag = NavigatorInputGuard.normalizeSearch(this.packet.readString());
 
         this.client.sendResponse(new PrivateRoomsComposer(Emulator.getGameEnvironment().getRoomManager().getRoomsWithTag(tag)));
     }

Emulator/src/main/java/com/eu/habbo/messages/incoming/navigator/SearchRoomsEvent.java

@@ -34,36 +34,43 @@ public class SearchRoomsEvent extends MessageHandler {
 
     @Override
     public void handle() throws Exception {
-        String name = this.packet.readString();
+        String name = NavigatorInputGuard.normalizeSearch(this.packet.readString());
 
         String prefix = "";
         String query = name;
         ArrayList<Room> rooms;
 
+        if (name.startsWith("owner:")) {
+            query = NavigatorInputGuard.normalizeSearch(name.substring("owner:".length()));
+            prefix = "owner:";
+        } else if (name.startsWith("tag:")) {
+            query = NavigatorInputGuard.normalizeSearch(name.substring("tag:".length()));
+            prefix = "tag:";
+        } else if (name.startsWith("group:")) {
+            query = NavigatorInputGuard.normalizeSearch(name.substring("group:".length()));
+            prefix = "group:";
+        }
+
+        String cacheKey = buildCacheKey(prefix, query);
+
         ServerMessage message = null;
         Map<String, ServerMessage> rankCache = cachedResults.get(this.client.getHabbo().getHabboInfo().getRank());
         if (rankCache != null) {
-            message = rankCache.get((name + "\t" + query).toLowerCase());
+            message = rankCache.get(cacheKey);
         } else {
             rankCache = createLRUCache();
             cachedResults.put(this.client.getHabbo().getHabboInfo().getRank(), rankCache);
         }
 
         if (message == null) {
-            if (name.startsWith("owner:")) {
-                query = name.split("owner:")[1];
-                prefix = "owner:";
-                rooms = (ArrayList<Room>) Emulator.getGameEnvironment().getRoomManager().getRoomsForHabbo(name);
-            } else if (name.startsWith("tag:")) {
-                query = name.split("tag:")[1];
-                prefix = "tag:";
-                rooms = Emulator.getGameEnvironment().getRoomManager().getRoomsWithTag(name);
-            } else if (name.startsWith("group:")) {
-                query = name.split("group:")[1];
-                prefix = "group:";
-                rooms = Emulator.getGameEnvironment().getRoomManager().getGroupRoomsWithName(name);
+            if (prefix.equals("owner:")) {
+                rooms = (ArrayList<Room>) Emulator.getGameEnvironment().getRoomManager().getRoomsForHabbo(query);
+            } else if (prefix.equals("tag:")) {
+                rooms = Emulator.getGameEnvironment().getRoomManager().getRoomsWithTag(query);
+            } else if (prefix.equals("group:")) {
+                rooms = Emulator.getGameEnvironment().getRoomManager().getGroupRoomsWithName(query);
             } else {
-                rooms = Emulator.getGameEnvironment().getRoomManager().getRoomsWithName(name);
+                rooms = Emulator.getGameEnvironment().getRoomManager().getRoomsWithName(query);
             }
 
             message = new PrivateRoomsComposer(rooms).compose();
@@ -73,7 +80,7 @@ public class SearchRoomsEvent extends MessageHandler {
                 map = createLRUCache();
             }
 
-            map.put((name + "\t" + query).toLowerCase(), message);
+            map.put(cacheKey, message);
             cachedResults.put(this.client.getHabbo().getHabboInfo().getRank(), map);
 
             NavigatorSearchResultEvent event = new NavigatorSearchResultEvent(this.client.getHabbo(), prefix, query, rooms);
@@ -84,4 +91,8 @@ public class SearchRoomsEvent extends MessageHandler {
 
         this.client.sendResponse(message);
     }
+
+    private static String buildCacheKey(String prefix, String query) {
+        return (prefix + "\t" + query).toLowerCase();
+    }
 }

Emulator/src/main/java/com/eu/habbo/messages/incoming/polls/AnswerPollEvent.java

@@ -16,6 +16,9 @@ import java.sql.SQLException;
 
 public class AnswerPollEvent extends MessageHandler {
     private static final Logger LOGGER = LoggerFactory.getLogger(AnswerPollEvent.class);
+    private static final int MAX_ANSWER_COUNT = 20;
+    private static final int MAX_ANSWER_PART_LENGTH = 255;
+    private static final int MAX_COMBINED_ANSWER_LENGTH = 2048;
 
     @Override
     public void handle() throws Exception {
@@ -23,13 +26,19 @@ public class AnswerPollEvent extends MessageHandler {
         int questionId = this.packet.readInt();
         int count = this.packet.readInt();
         String answers = this.packet.readString();
+        if (count <= 0 || count > MAX_ANSWER_COUNT || answers == null || answers.length() > MAX_ANSWER_PART_LENGTH) {
+            return;
+        }
         
         StringBuilder answer = new StringBuilder();
         for (int i = 0; i < count; i++) {
             answer.append(":").append(answers);
+            if (answer.length() > MAX_COMBINED_ANSWER_LENGTH) {
+                return;
+            }
         }
 
-        if(answer.length() <= 0) return;
+        if (answer.length() <= 0) return;
 
         if (pollId == 0 && questionId <= 0) {
             Room room = this.client.getHabbo().getHabboInfo().getCurrentRoom();

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/RoomSettingsSaveEvent.java

@@ -15,6 +15,15 @@ import java.util.Set;
 
 public class RoomSettingsSaveEvent extends MessageHandler {
     private static final Logger LOGGER = LoggerFactory.getLogger(RoomSettingsSaveEvent.class);
+    private static final int MAX_ROOM_PASSWORD_LENGTH = 64;
+    private static final int MAX_TAGS = 2;
+    private static final int MIN_USERS_MAX = 1;
+    private static final int MAX_USERS_MAX = 200;
+    private static final int MIN_THICKNESS = -2;
+    private static final int MAX_THICKNESS = 1;
+    private static final int MAX_OPTION_LEVEL = 2;
+    private static final int MIN_CHAT_DISTANCE = 1;
+    private static final int MAX_CHAT_DISTANCE = 99;
 
     @Override
     public void handle() throws Exception {
@@ -47,19 +56,33 @@ public class RoomSettingsSaveEvent extends MessageHandler {
                     return;
                 }
 
-                RoomState state = RoomState.values()[this.packet.readInt() % RoomState.values().length];
+                int stateId = this.packet.readInt();
+                if (stateId < 0 || stateId >= RoomState.values().length) {
+                    return;
+                }
+                RoomState state = RoomState.values()[stateId];
 
                 String password = this.packet.readString();
+                if (password.length() > MAX_ROOM_PASSWORD_LENGTH) {
+                    return;
+                }
                 if (state == RoomState.PASSWORD && password.isEmpty() && (room.getPassword() == null || room.getPassword().isEmpty())) {
                     this.client.sendResponse(new RoomEditSettingsErrorComposer(room.getId(), RoomEditSettingsErrorComposer.PASSWORD_REQUIRED, ""));
                     return;
                 }
 
                 int usersMax = this.packet.readInt();
+                if (usersMax < MIN_USERS_MAX || usersMax > MAX_USERS_MAX) {
+                    return;
+                }
+
                 int categoryId = this.packet.readInt();
                 StringBuilder tags = new StringBuilder();
                 Set<String> uniqueTags = new HashSet<>();
-                int count = Math.min(this.packet.readInt(), 2);
+                int count = this.packet.readInt();
+                if (count < 0 || count > MAX_TAGS) {
+                    return;
+                }
                 for (int i = 0; i < count; i++) {
                     String tag = this.packet.readString();
 
@@ -113,22 +136,52 @@ public class RoomSettingsSaveEvent extends MessageHandler {
                 }
 
 
+                int tradeMode = this.packet.readInt();
+                boolean allowPets = this.packet.readBoolean();
+                boolean allowPetsEat = this.packet.readBoolean();
+                boolean allowWalkthrough = this.packet.readBoolean();
+                boolean hideWall = this.packet.readBoolean();
+                int wallSize = this.packet.readInt();
+                int floorSize = this.packet.readInt();
+                int muteOption = this.packet.readInt();
+                int kickOption = this.packet.readInt();
+                int banOption = this.packet.readInt();
+                int chatMode = this.packet.readInt();
+                int chatWeight = this.packet.readInt();
+                int chatSpeed = this.packet.readInt();
+                int chatDistance = this.packet.readInt();
+                int chatProtection = this.packet.readInt();
+
+                if (!isInRange(tradeMode, 0, MAX_OPTION_LEVEL)
+                        || !isInRange(wallSize, MIN_THICKNESS, MAX_THICKNESS)
+                        || !isInRange(floorSize, MIN_THICKNESS, MAX_THICKNESS)
+                        || !isInRange(muteOption, 0, MAX_OPTION_LEVEL)
+                        || !isInRange(kickOption, 0, MAX_OPTION_LEVEL)
+                        || !isInRange(banOption, 0, MAX_OPTION_LEVEL)
+                        || !isInRange(chatMode, 0, MAX_OPTION_LEVEL)
+                        || !isInRange(chatWeight, 0, MAX_OPTION_LEVEL)
+                        || !isInRange(chatSpeed, 0, MAX_OPTION_LEVEL)
+                        || !isInRange(chatDistance, MIN_CHAT_DISTANCE, MAX_CHAT_DISTANCE)
+                        || !isInRange(chatProtection, 0, MAX_OPTION_LEVEL)) {
+                    return;
+                }
+
                 room.setTags(tags.toString());
-                room.setTradeMode(this.packet.readInt());
-                room.setAllowPets(this.packet.readBoolean());
-                room.setAllowPetsEat(this.packet.readBoolean());
-                room.setAllowWalkthrough(this.packet.readBoolean());
-                room.setHideWall(this.packet.readBoolean());
-                room.setWallSize(this.packet.readInt());
-                room.setFloorSize(this.packet.readInt());
-                room.setMuteOption(this.packet.readInt());
-                room.setKickOption(this.packet.readInt());
-                room.setBanOption(this.packet.readInt());
-                room.setChatMode(this.packet.readInt());
-                room.setChatWeight(this.packet.readInt());
-                room.setChatSpeed(this.packet.readInt());
-                room.setChatDistance(Math.abs(this.packet.readInt()));
-                room.setChatProtection(this.packet.readInt());
+                room.setTradeMode(tradeMode);
+                room.setAllowPets(allowPets);
+                room.setAllowPetsEat(allowPetsEat);
+                room.setAllowWalkthrough(allowWalkthrough);
+                room.setHideWall(hideWall);
+                room.setWallSize(wallSize);
+                room.setFloorSize(floorSize);
+                room.setMuteOption(muteOption);
+                room.setKickOption(kickOption);
+                room.setBanOption(banOption);
+                room.setChatMode(chatMode);
+                room.setChatWeight(chatWeight);
+                room.setChatSpeed(chatSpeed);
+                room.setChatDistance(chatDistance);
+                room.setChatProtection(chatProtection);
 
                 if (this.packet.bytesAvailable() > 0) {
                     room.setAllowUnderpass(this.packet.readBoolean());
@@ -144,4 +197,8 @@ public class RoomSettingsSaveEvent extends MessageHandler {
             }
         }
     }
+
+    private static boolean isInRange(int value, int min, int max) {
+        return value >= min && value <= max;
+    }
 }

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/items/AdvertisingSaveEvent.java

@@ -18,7 +18,11 @@ public class AdvertisingSaveEvent extends MessageHandler {
         if (!room.hasRights(this.client.getHabbo()))
             return;
 
-        HabboItem item = room.getHabboItem(this.packet.readInt());
+        int itemId = this.packet.readInt();
+        if (!RoomItemInputGuard.isPositiveId(itemId))
+            return;
+
+        HabboItem item = room.getHabboItem(itemId);
         if (item == null)
             return;
 
@@ -29,9 +33,15 @@ public class AdvertisingSaveEvent extends MessageHandler {
         if (item instanceof InteractionCustomValues) {
             THashMap<String, String> oldValues = new THashMap<>(((InteractionCustomValues) item).values);
             int count = this.packet.readInt();
+            if (!RoomItemInputGuard.isValidCustomValueCount(count))
+                return;
+
             for (int i = 0; i < count / 2; i++) {
-                String key = this.packet.readString();
-                String value = this.packet.readString();
+                String key = RoomItemInputGuard.trimToMax(this.packet.readString(), RoomItemInputGuard.MAX_CUSTOM_KEY_LENGTH);
+                String value = RoomItemInputGuard.trimToMax(this.packet.readString(), RoomItemInputGuard.MAX_CUSTOM_VALUE_LENGTH);
+
+                if (key.isEmpty())
+                    continue;
 
                 if (!Emulator.getConfig().getBoolean("camera.use.https")) {
                     value = value.replace("https://", "http://");

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/items/FootballGateSaveLookEvent.java

@@ -13,15 +13,21 @@ public class FootballGateSaveLookEvent extends MessageHandler {
         if (room == null || this.client.getHabbo().getHabboInfo().getId() != room.getOwnerId())
             return;
 
-        HabboItem item = room.getHabboItem(this.packet.readInt());
+        int itemId = this.packet.readInt();
+        if (!RoomItemInputGuard.isPositiveId(itemId))
+            return;
+
+        HabboItem item = room.getHabboItem(itemId);
         if (!(item instanceof InteractionFootballGate))
             return;
 
         String gender = this.packet.readString();
-        String look = this.packet.readString();
+        String look = RoomItemInputGuard.trimToMax(this.packet.readString(), RoomItemInputGuard.MAX_LOOK_LENGTH);
+
+        if (!RoomItemInputGuard.isValidGender(gender) || look.isEmpty())
+            return;
 
         switch (gender.toLowerCase()) {
-            default:
             case "m":
                 ((InteractionFootballGate) item).setFigureM(look);
                 room.updateItem(item);

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/items/MannequinSaveLookEvent.java

@@ -15,7 +15,11 @@ public class MannequinSaveLookEvent extends MessageHandler {
         if (room == null || !room.isOwner(habbo))
             return;
 
-        HabboItem item = room.getHabboItem(this.packet.readInt());
+        int itemId = this.packet.readInt();
+        if (!RoomItemInputGuard.isPositiveId(itemId))
+            return;
+
+        HabboItem item = room.getHabboItem(itemId);
         if (item == null)
             return;
 

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/items/MannequinSaveNameEvent.java

@@ -12,12 +12,16 @@ public class MannequinSaveNameEvent extends MessageHandler {
         if (room == null || !room.isOwner(this.client.getHabbo()))
             return;
 
-        HabboItem item = room.getHabboItem(this.packet.readInt());
+        int itemId = this.packet.readInt();
+        if (!RoomItemInputGuard.isPositiveId(itemId))
+            return;
+
+        HabboItem item = room.getHabboItem(itemId);
         if (item == null)
             return;
 
         String[] data = item.getExtradata().split(":");
-        String name = this.packet.readString();
+        String name = RoomItemInputGuard.trimToMax(this.packet.readString(), 32);
 
         if (name.length() < 3 || name.length() > 15) {
             name = Emulator.getTexts().getValue("hotel.mannequin.name.default", "My look");

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/items/MoodLightSaveSettingsEvent.java

@@ -21,6 +21,9 @@ public class MoodLightSaveSettingsEvent extends MessageHandler {
     public void handle() throws Exception {
         Room room = this.client.getHabbo().getHabboInfo().getCurrentRoom();
 
+        if (room == null)
+            return;
+
         if ((room.getGuildId() <= 0 && room.getGuildRightLevel(this.client.getHabbo()).isLessThan(RoomRightLevels.GUILD_RIGHTS)) && !room.hasRights(this.client.getHabbo()))
             return;
 

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/items/MoveWallItemEvent.java

@@ -25,7 +25,7 @@ public class MoveWallItemEvent extends MessageHandler {
         int itemId = this.packet.readInt();
         String wallPosition = this.packet.readString();
 
-        if (itemId <= 0 || wallPosition.length() <= 13)
+        if (!RoomItemInputGuard.isPositiveId(itemId) || wallPosition.length() <= 13)
             return;
 
         HabboItem item = room.getHabboItem(itemId);

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/items/PostItDeleteEvent.java

@@ -15,6 +15,9 @@ public class PostItDeleteEvent extends MessageHandler {
     public void handle() throws Exception {
         int itemId = this.packet.readInt();
 
+        if (!RoomItemInputGuard.isPositiveId(itemId))
+            return;
+
         Room room = this.client.getHabbo().getHabboInfo().getCurrentRoom();
 
         if (room == null)

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/items/PostItPlaceEvent.java

@@ -19,6 +19,9 @@ public class PostItPlaceEvent extends MessageHandler {
         int itemId = this.packet.readInt();
         String location = this.packet.readString();
 
+        if (!RoomItemInputGuard.isPositiveId(itemId) || location.length() <= 13)
+            return;
+
         Room room = this.client.getHabbo().getHabboInfo().getCurrentRoom();
 
         if (room != null) {

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/items/PostItSaveDataEvent.java

@@ -20,6 +20,9 @@ public class PostItSaveDataEvent extends MessageHandler {
         String color = this.packet.readString();
         String text = Emulator.getGameEnvironment().getWordFilter().filter(this.packet.readString().replace(((char) 9) + "", ""), this.client.getHabbo());
 
+        if (!RoomItemInputGuard.isPositiveId(itemId))
+            return;
+
         if (text.length() > Emulator.getConfig().getInt("postit.charlimit")) {
             ScripterManager.scripterDetected(this.client, Emulator.getTexts().getValue("scripter.warning.sticky.size").replace("%username%", this.client.getHabbo().getHabboInfo().getUsername()).replace("%amount%", text.length() + "").replace("%limit%", Emulator.getConfig().getInt("postit.charlimit") + ""));
             return;

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/items/RedeemClothingEvent.java

@@ -26,6 +26,9 @@ public class RedeemClothingEvent extends MessageHandler {
     public void handle() throws Exception {
         int itemId = this.packet.readInt();
 
+        if (!RoomItemInputGuard.isPositiveId(itemId))
+            return;
+
         if (this.client.getHabbo().getHabboInfo().getCurrentRoom() != null &&
                 this.client.getHabbo().getHabboInfo().getCurrentRoom().hasRights(this.client.getHabbo())) {
             HabboItem item = this.client.getHabbo().getHabboInfo().getCurrentRoom().getHabboItem(itemId);
@@ -42,6 +45,10 @@ public class RedeemClothingEvent extends MessageHandler {
 
                             item.setRoomId(0);
                             RoomTile tile = this.client.getHabbo().getHabboInfo().getCurrentRoom().getLayout().getTile(item.getX(), item.getY());
+                            if (tile == null) {
+                                return;
+                            }
+
                             this.client.getHabbo().getHabboInfo().getCurrentRoom().removeHabboItem(item);
                             this.client.getHabbo().getHabboInfo().getCurrentRoom().updateTile(tile);
                             this.client.getHabbo().getHabboInfo().getCurrentRoom().sendComposer(new UpdateStackHeightComposer(tile.x, tile.y, tile.z, tile.relativeHeight()).compose());

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/items/RedeemItemEvent.java

@@ -19,6 +19,9 @@ public class RedeemItemEvent extends MessageHandler {
     public void handle() throws Exception {
         int itemId = this.packet.readInt();
 
+        if (!RoomItemInputGuard.isPositiveId(itemId))
+            return;
+
         Room room = this.client.getHabbo().getHabboInfo().getCurrentRoom();
 
         if (room != null) {
@@ -98,6 +101,9 @@ public class RedeemItemEvent extends MessageHandler {
                     room.removeHabboItem(item);
                     room.sendComposer(new RemoveFloorItemComposer(item).compose());
                     RoomTile t = room.getLayout().getTile(item.getX(), item.getY());
+                    if (t == null)
+                        return;
+
                     t.setStackHeight(room.getStackHeight(item.getX(), item.getY(), false));
                     room.updateTile(t);
                     room.sendComposer(new UpdateStackHeightComposer(item.getX(), item.getY(), t.z, t.relativeHeight()).compose());

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/items/RoomItemInputGuard.java

@@ -0,0 +1,51 @@
+package com.eu.habbo.messages.incoming.rooms.items;
+
+public final class RoomItemInputGuard {
+    public static final int MAX_CUSTOM_VALUE_PAIRS = 20;
+    public static final int MAX_CUSTOM_KEY_LENGTH = 64;
+    public static final int MAX_CUSTOM_VALUE_LENGTH = 512;
+    public static final int MAX_LOOK_LENGTH = 512;
+    public static final int MAX_YOUTUBE_PLAYLIST_ID_LENGTH = 128;
+    public static final int MAX_STICKY_POLE_COMMANDS = 10;
+    public static final int MAX_STICKY_POLE_COMMAND_LENGTH = 255;
+
+    private RoomItemInputGuard() {
+    }
+
+    public static boolean isPositiveId(int id) {
+        return id > 0;
+    }
+
+    public static boolean isValidCustomValueCount(int count) {
+        return count > 0 && count % 2 == 0 && count / 2 <= MAX_CUSTOM_VALUE_PAIRS;
+    }
+
+    public static String trimToMax(String value, int maxLength) {
+        if (value == null) {
+            return "";
+        }
+
+        String trimmed = value.trim();
+        return trimmed.length() > maxLength ? trimmed.substring(0, maxLength) : trimmed;
+    }
+
+    public static boolean isValidGender(String gender) {
+        return "m".equalsIgnoreCase(gender) || "f".equalsIgnoreCase(gender);
+    }
+
+    public static Integer parseInt(String value) {
+        try {
+            return Integer.parseInt(value);
+        } catch (NumberFormatException e) {
+            return null;
+        }
+    }
+
+    public static Short parseShort(String value) {
+        try {
+            return Short.parseShort(value);
+        } catch (NumberFormatException e) {
+            return null;
+        }
+    }
+}

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/items/RoomPickupItemEvent.java

@@ -12,6 +12,9 @@ public class RoomPickupItemEvent extends MessageHandler {
         this.packet.readInt(); //10 = floorItem and 20 = wallItem
         int itemId = this.packet.readInt();
 
+        if (!RoomItemInputGuard.isPositiveId(itemId))
+            return;
+
         Room room = this.client.getHabbo().getHabboInfo().getCurrentRoom();
 
         if (room == null)

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/items/RoomPlaceItemEvent.java

@@ -18,9 +18,12 @@ public class RoomPlaceItemEvent extends MessageHandler {
     public void handle() throws Exception {
         String[] values = this.packet.readString().split(" ");
 
-        int itemId = -1;
+        if (values.length == 0)
+            return;
 
-        if (values.length != 0) itemId = Integer.parseInt(values[0]);
+        Integer itemId = RoomItemInputGuard.parseInt(values[0]);
+        if (itemId == null || !RoomItemInputGuard.isPositiveId(itemId))
+            return;
 
         if (!this.client.getHabbo().getRoomUnit().isInRoom()) {
             this.client.sendResponse(new BubbleAlertComposer(BubbleAlertKeys.FURNITURE_PLACEMENT_ERROR.key, FurnitureMovementError.NO_RIGHTS.errorCode));
@@ -56,9 +59,15 @@ public class RoomPlaceItemEvent extends MessageHandler {
         }
 
         if (item.getBaseItem().getType() == FurnitureType.FLOOR) {
-            short x = Short.parseShort(values[1]);
-            short y = Short.parseShort(values[2]);
-            int rotation = Integer.parseInt(values[3]);
+            if (values.length < 4)
+                return;
+
+            Short x = RoomItemInputGuard.parseShort(values[1]);
+            Short y = RoomItemInputGuard.parseShort(values[2]);
+            Integer rotation = RoomItemInputGuard.parseInt(values[3]);
+
+            if (x == null || y == null || rotation == null)
+                return;
 
             RoomTile tile = room.getLayout().getTile(x, y);
 
@@ -108,6 +117,9 @@ public class RoomPlaceItemEvent extends MessageHandler {
                 return;
             }
         } else {
+            if (values.length < 4)
+                return;
+
             FurnitureMovementError error = room.placeWallFurniAt(item, values[1] + " " + values[2] + " " + values[3], this.client.getHabbo());
             if (!error.equals(FurnitureMovementError.NONE)) {
                 this.client.sendResponse(new BubbleAlertComposer(BubbleAlertKeys.FURNITURE_PLACEMENT_ERROR.key, error.errorCode));

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/items/RotateMoveItemEvent.java

@@ -16,6 +16,8 @@ public class RotateMoveItemEvent extends MessageHandler {
         if (room == null) return;
 
         int furniId = this.packet.readInt();
+        if (!RoomItemInputGuard.isPositiveId(furniId)) return;
+
         HabboItem item = room.getHabboItem(furniId);
         if (item == null) return;
 

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/items/SavePostItStickyPoleEvent.java

@@ -24,9 +24,14 @@ public class SavePostItStickyPoleEvent extends MessageHandler {
         if (itemId == -1234) {
             if (this.client.getHabbo().hasPermission("cmd_multi")) {
                 String[] commands = this.packet.readString().split("\r");
+                if (commands.length > RoomItemInputGuard.MAX_STICKY_POLE_COMMANDS)
+                    return;
 
                 for (String command : commands) {
-                    command = command.replace("<br>", "\r");
+                    command = RoomItemInputGuard.trimToMax(command.replace("<br>", "\r"), RoomItemInputGuard.MAX_STICKY_POLE_COMMAND_LENGTH);
+                    if (command.isEmpty())
+                        continue;
+
                     CommandHandler.handleCommand(this.client, command);
                 }
             } else {
@@ -38,6 +43,9 @@ public class SavePostItStickyPoleEvent extends MessageHandler {
             if (text.length() > Emulator.getConfig().getInt("postit.charlimit"))
                 return;
 
+            if (!RoomItemInputGuard.isPositiveId(itemId))
+                return;
+
             Room room = this.client.getHabbo().getHabboInfo().getCurrentRoom();
             if (room == null)
                 return;

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/items/ToggleFloorItemEvent.java

@@ -41,6 +41,9 @@ public class ToggleFloorItemEvent extends MessageHandler {
             int itemId = this.packet.readInt();
             int state = this.packet.readInt();
 
+            if (!RoomItemInputGuard.isPositiveId(itemId))
+                return;
+
             HabboItem item = room.getHabboItem(itemId);
 
             if (item == null || item instanceof InteractionDice)

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/items/ToggleWallItemEvent.java

@@ -24,6 +24,9 @@ public class ToggleWallItemEvent extends MessageHandler {
         int itemId = this.packet.readInt();
         int state = this.packet.readInt();
 
+        if (!RoomItemInputGuard.isPositiveId(itemId))
+            return;
+
         HabboItem item = room.getHabboItem(itemId);
 
         if (item == null)

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/items/UpdateFurniturePositionEvent.java

@@ -20,6 +20,8 @@ public class UpdateFurniturePositionEvent extends MessageHandler {
         if (room == null) return;
 
         int furniId = this.packet.readInt();
+        if (!RoomItemInputGuard.isPositiveId(furniId)) return;
+
         HabboItem item = room.getHabboItem(furniId);
         if (item == null) return;
 

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/items/jukebox/JukeBoxAddSoundTrackEvent.java

@@ -1,25 +1,31 @@
 package com.eu.habbo.messages.incoming.rooms.items.jukebox;
 
 import com.eu.habbo.habbohotel.items.interactions.InteractionMusicDisc;
+import com.eu.habbo.habbohotel.rooms.Room;
 import com.eu.habbo.habbohotel.users.Habbo;
 import com.eu.habbo.habbohotel.users.HabboItem;
 import com.eu.habbo.messages.incoming.MessageHandler;
+import com.eu.habbo.messages.incoming.rooms.items.RoomItemInputGuard;
 
 public class JukeBoxAddSoundTrackEvent extends MessageHandler {
     @Override
     public void handle() throws Exception {
-        if (!this.client.getHabbo().getHabboInfo().getCurrentRoom().hasRights(this.client.getHabbo())) return;
+        Room room = this.client.getHabbo().getHabboInfo().getCurrentRoom();
+        if (room == null || !room.hasRights(this.client.getHabbo())) return;
 
         int itemId = this.packet.readInt();
         this.packet.readInt(); // slotId
 
+        if (!RoomItemInputGuard.isPositiveId(itemId))
+            return;
+
         Habbo habbo = this.client.getHabbo();
 
         if (habbo != null) {
             HabboItem item = habbo.getInventory().getItemsComponent().getHabboItem(itemId);
 
             if (item instanceof InteractionMusicDisc && item.getRoomId() == 0) {
-                this.client.getHabbo().getHabboInfo().getCurrentRoom().getTraxManager().addSong((InteractionMusicDisc) item, habbo);
+                room.getTraxManager().addSong((InteractionMusicDisc) item, habbo);
             }
         }
     }

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/items/jukebox/JukeBoxRemoveSoundTrackEvent.java

@@ -1,6 +1,7 @@
 package com.eu.habbo.messages.incoming.rooms.items.jukebox;
 
 import com.eu.habbo.habbohotel.items.interactions.InteractionMusicDisc;
+import com.eu.habbo.habbohotel.rooms.Room;
 import com.eu.habbo.messages.incoming.MessageHandler;
 
 public class JukeBoxRemoveSoundTrackEvent extends MessageHandler {
@@ -8,12 +9,16 @@ public class JukeBoxRemoveSoundTrackEvent extends MessageHandler {
     public void handle() throws Exception {
         int index = this.packet.readInt();
 
-        if (this.client.getHabbo().getHabboInfo().getCurrentRoom() == null) return;
+        Room room = this.client.getHabbo().getHabboInfo().getCurrentRoom();
+        if (room == null) return;
 
-        InteractionMusicDisc musicDisc = this.client.getHabbo().getHabboInfo().getCurrentRoom().getTraxManager().getSongs().get(index);
+        if (index < 0 || index >= room.getTraxManager().getSongs().size())
+            return;
+
+        InteractionMusicDisc musicDisc = room.getTraxManager().getSongs().get(index);
 
         if (musicDisc != null) {
-            this.client.getHabbo().getHabboInfo().getCurrentRoom().getTraxManager().removeSong(musicDisc.getId());
+            room.getTraxManager().removeSong(musicDisc.getId());
         }
     }
 }

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/items/jukebox/JukeBoxRequestPlayListEvent.java

@@ -1,6 +1,7 @@
 package com.eu.habbo.messages.incoming.rooms.items.jukebox;
 
 import com.eu.habbo.habbohotel.rooms.TraxManager;
+import com.eu.habbo.habbohotel.rooms.Room;
 import com.eu.habbo.messages.incoming.MessageHandler;
 import com.eu.habbo.messages.outgoing.rooms.items.jukebox.JukeBoxMySongsComposer;
 import com.eu.habbo.messages.outgoing.rooms.items.jukebox.JukeBoxPlayListComposer;
@@ -8,9 +9,13 @@ import com.eu.habbo.messages.outgoing.rooms.items.jukebox.JukeBoxPlayListCompose
 public class JukeBoxRequestPlayListEvent extends MessageHandler {
     @Override
     public void handle() throws Exception {
-        TraxManager traxManager = this.client.getHabbo().getHabboInfo().getCurrentRoom().getTraxManager();
+        Room room = this.client.getHabbo().getHabboInfo().getCurrentRoom();
+        if (room == null)
+            return;
+
+        TraxManager traxManager = room.getTraxManager();
         this.client.sendResponse(new JukeBoxPlayListComposer(traxManager.getSongs(), traxManager.totalLength()));
         this.client.sendResponse(new JukeBoxMySongsComposer(traxManager.myList(this.client.getHabbo())));
-        this.client.getHabbo().getHabboInfo().getCurrentRoom().getTraxManager().updateCurrentPlayingSong(this.client.getHabbo());
+        traxManager.updateCurrentPlayingSong(this.client.getHabbo());
     }
 }

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/items/lovelock/LoveLockStartConfirmEvent.java

@@ -4,6 +4,7 @@ import com.eu.habbo.habbohotel.items.interactions.InteractionLoveLock;
 import com.eu.habbo.habbohotel.users.Habbo;
 import com.eu.habbo.habbohotel.users.HabboItem;
 import com.eu.habbo.messages.incoming.MessageHandler;
+import com.eu.habbo.messages.incoming.rooms.items.RoomItemInputGuard;
 import com.eu.habbo.messages.outgoing.rooms.items.lovelock.LoveLockFurniFinishedComposer;
 import com.eu.habbo.messages.outgoing.rooms.items.lovelock.LoveLockFurniFriendConfirmedComposer;
 
@@ -12,6 +13,9 @@ public class LoveLockStartConfirmEvent extends MessageHandler {
     public void handle() throws Exception {
         int itemId = this.packet.readInt();
 
+        if (!RoomItemInputGuard.isPositiveId(itemId))
+            return;
+
         if (this.packet.readBoolean()) {
             if (this.client.getHabbo().getHabboInfo().getCurrentRoom() == null)
                 return;

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/items/rentablespace/RentSpaceCancelEvent.java

@@ -5,12 +5,16 @@ import com.eu.habbo.habbohotel.permissions.Permission;
 import com.eu.habbo.habbohotel.rooms.Room;
 import com.eu.habbo.habbohotel.users.HabboItem;
 import com.eu.habbo.messages.incoming.MessageHandler;
+import com.eu.habbo.messages.incoming.rooms.items.RoomItemInputGuard;
 
 public class RentSpaceCancelEvent extends MessageHandler {
     @Override
     public void handle() throws Exception {
         int itemId = this.packet.readInt();
 
+        if (!RoomItemInputGuard.isPositiveId(itemId))
+            return;
+
         Room room = this.client.getHabbo().getHabboInfo().getCurrentRoom();
 
         if (room == null)

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/items/rentablespace/RentSpaceEvent.java

@@ -4,12 +4,16 @@ import com.eu.habbo.habbohotel.items.interactions.InteractionRentableSpace;
 import com.eu.habbo.habbohotel.rooms.Room;
 import com.eu.habbo.habbohotel.users.HabboItem;
 import com.eu.habbo.messages.incoming.MessageHandler;
+import com.eu.habbo.messages.incoming.rooms.items.RoomItemInputGuard;
 
 public class RentSpaceEvent extends MessageHandler {
     @Override
     public void handle() throws Exception {
         int itemId = this.packet.readInt();
 
+        if (!RoomItemInputGuard.isPositiveId(itemId))
+            return;
+
         Room room = this.client.getHabbo().getHabboInfo().getCurrentRoom();
 
         if (room == null)

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/items/youtube/YoutubeRequestPlaylistChange.java

@@ -8,6 +8,7 @@ import com.eu.habbo.habbohotel.rooms.Room;
 import com.eu.habbo.habbohotel.users.Habbo;
 import com.eu.habbo.habbohotel.users.HabboItem;
 import com.eu.habbo.messages.incoming.MessageHandler;
+import com.eu.habbo.messages.incoming.rooms.items.RoomItemInputGuard;
 import com.eu.habbo.messages.outgoing.rooms.items.youtube.YoutubeVideoComposer;
 import com.eu.habbo.threading.runnables.YoutubeAdvanceVideo;
 
@@ -17,7 +18,10 @@ public class YoutubeRequestPlaylistChange extends MessageHandler {
     @Override
     public void handle() throws Exception {
         int itemId = this.packet.readInt();
-        String playlistId = this.packet.readString();
+        String playlistId = RoomItemInputGuard.trimToMax(this.packet.readString(), RoomItemInputGuard.MAX_YOUTUBE_PLAYLIST_ID_LENGTH);
+
+        if (!RoomItemInputGuard.isPositiveId(itemId) || playlistId.isEmpty())
+            return;
 
         Habbo habbo = this.client.getHabbo();
 
@@ -30,13 +34,16 @@ public class YoutubeRequestPlaylistChange extends MessageHandler {
         if (!room.isOwner(habbo) && !habbo.hasPermission(Permission.ACC_ANYROOMOWNER)) return;
 
 
-        HabboItem item = this.client.getHabbo().getHabboInfo().getCurrentRoom().getHabboItem(itemId);
+        HabboItem item = room.getHabboItem(itemId);
 
         if (item == null || !(item instanceof  InteractionYoutubeTV)) return;
 
         Optional<YoutubeManager.YoutubePlaylist> playlist = Emulator.getGameEnvironment().getItemManager().getYoutubeManager().getPlaylistsForItemId(item.getId()).stream().filter(p -> p.getId().equals(playlistId)).findAny();
 
         if (playlist.isPresent()) {
+            if (playlist.get().getVideos().isEmpty())
+                return;
+
             YoutubeManager.YoutubeVideo video = playlist.get().getVideos().get(0);
             if (video == null) return;
 

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/items/youtube/YoutubeRequestPlaylists.java

@@ -5,6 +5,7 @@ import com.eu.habbo.habbohotel.items.YoutubeManager;
 import com.eu.habbo.habbohotel.items.interactions.InteractionYoutubeTV;
 import com.eu.habbo.habbohotel.users.HabboItem;
 import com.eu.habbo.messages.incoming.MessageHandler;
+import com.eu.habbo.messages.incoming.rooms.items.RoomItemInputGuard;
 import com.eu.habbo.messages.outgoing.handshake.ConnectionErrorComposer;
 import com.eu.habbo.messages.outgoing.rooms.items.youtube.YoutubeDisplayListComposer;
 import org.slf4j.Logger;
@@ -19,6 +20,9 @@ public class YoutubeRequestPlaylists extends MessageHandler {
     public void handle() throws Exception {
         int itemId = this.packet.readInt();
 
+        if (!RoomItemInputGuard.isPositiveId(itemId))
+            return;
+
         if (this.client.getHabbo().getHabboInfo().getCurrentRoom() != null) {
             HabboItem item = this.client.getHabbo().getHabboInfo().getCurrentRoom().getHabboItem(itemId);
 

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/items/youtube/YoutubeRequestStateChange.java

@@ -7,6 +7,7 @@ import com.eu.habbo.habbohotel.rooms.Room;
 import com.eu.habbo.habbohotel.users.Habbo;
 import com.eu.habbo.habbohotel.users.HabboItem;
 import com.eu.habbo.messages.incoming.MessageHandler;
+import com.eu.habbo.messages.incoming.rooms.items.RoomItemInputGuard;
 import com.eu.habbo.messages.outgoing.rooms.items.youtube.YoutubeStateChangeComposer;
 import com.eu.habbo.messages.outgoing.rooms.items.youtube.YoutubeVideoComposer;
 import com.eu.habbo.threading.runnables.YoutubeAdvanceVideo;
@@ -49,6 +50,9 @@ public class YoutubeRequestStateChange extends MessageHandler {
         int itemId = this.packet.readInt();
         YoutubeState state = YoutubeState.getByState(this.packet.readInt());
 
+        if (!RoomItemInputGuard.isPositiveId(itemId))
+            return;
+
         if (state == null) return;
 
         Habbo habbo = this.client.getHabbo();
@@ -62,7 +66,7 @@ public class YoutubeRequestStateChange extends MessageHandler {
         if (!room.isOwner(habbo) && !habbo.hasPermission(Permission.ACC_ANYROOMOWNER)) return;
 
 
-        HabboItem item = this.client.getHabbo().getHabboInfo().getCurrentRoom().getHabboItem(itemId);
+        HabboItem item = room.getHabboItem(itemId);
 
         if (!(item instanceof InteractionYoutubeTV)) return;
 

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/users/RoomUserActionEvent.java

@@ -28,6 +28,9 @@ public class RoomUserActionEvent extends MessageHandler {
             }
 
             int action = this.packet.readInt();
+            if (!RoomUserInputGuard.isValidAction(action))
+                return;
+
             int wiredAction = 0;
 
             if (action == 5) {

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/users/RoomUserBanEvent.java

@@ -12,6 +12,10 @@ public class RoomUserBanEvent extends MessageHandler {
         int roomId = this.packet.readInt();
         String banName = this.packet.readString();
 
+        if (!RoomUserInputGuard.isPositiveId(userId) || !RoomUserInputGuard.isPositiveId(roomId)) {
+            return;
+        }
+
         Room room = this.client.getHabbo().getHabboInfo().getCurrentRoom();
         if (room == null || room.getId() != roomId) {
             return;

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/users/RoomUserGiveRightsEvent.java

@@ -13,6 +13,10 @@ public class RoomUserGiveRightsEvent extends MessageHandler {
     public void handle() throws Exception {
         int userId = this.packet.readInt();
 
+        if (!RoomUserInputGuard.isPositiveId(userId)) {
+            return;
+        }
+
         Room room = this.client.getHabbo().getHabboInfo().getCurrentRoom();
 
         if (room == null)

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/users/RoomUserInputGuard.java

@@ -0,0 +1,17 @@
+package com.eu.habbo.messages.incoming.rooms.users;
+
+final class RoomUserInputGuard {
+    static final int MIN_ACTION_ID = 0;
+    static final int MAX_ACTION_ID = 7;
+
+    private RoomUserInputGuard() {
+    }
+
+    static boolean isPositiveId(int id) {
+        return id > 0;
+    }
+
+    static boolean isValidAction(int action) {
+        return action >= MIN_ACTION_ID && action <= MAX_ACTION_ID;
+    }
+}

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/users/RoomUserKickEvent.java

@@ -21,6 +21,9 @@ public class RoomUserKickEvent extends MessageHandler {
 
         int userId = this.packet.readInt();
 
+        if (!RoomUserInputGuard.isPositiveId(userId))
+            return;
+
         Habbo target = room.getHabbo(userId);
 
         if (target == null)
@@ -35,15 +38,15 @@ public class RoomUserKickEvent extends MessageHandler {
             return;
         }
 
+        if (room.hasRights(this.client.getHabbo()) || this.client.getHabbo().hasPermission(Permission.ACC_ANYROOMOWNER) || this.client.getHabbo().hasPermission(Permission.ACC_AMBASSADOR)) {
+            if (target.hasPermission(Permission.ACC_UNKICKABLE)) return;
+
             UserKickEvent event = new UserKickEvent(this.client.getHabbo(), target);
             Emulator.getPluginManager().fireEvent(event);
 
             if (event.isCancelled())
                 return;
 
-        if (room.hasRights(this.client.getHabbo()) || this.client.getHabbo().hasPermission(Permission.ACC_ANYROOMOWNER) || this.client.getHabbo().hasPermission(Permission.ACC_AMBASSADOR)) {
-            if (target.hasPermission(Permission.ACC_UNKICKABLE)) return;
-
             room.kickHabbo(target, true);
             AchievementManager.progressAchievement(this.client.getHabbo(), Emulator.getGameEnvironment().getAchievementManager().getAchievement("SelfModKickSeen"));
         }

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/users/RoomUserMuteEvent.java

@@ -18,6 +18,10 @@ public class RoomUserMuteEvent extends MessageHandler {
         int roomId = this.packet.readInt();
         int minutes = this.packet.readInt();
 
+        if (!RoomUserInputGuard.isPositiveId(userId) || !RoomUserInputGuard.isPositiveId(roomId)) {
+            return;
+        }
+
         Room room = this.client.getHabbo().getHabboInfo().getCurrentRoom();
         if (room == null || room.getId() != roomId) {
             return;

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/users/RoomUserRemoveRightsEvent.java

@@ -27,6 +27,9 @@ public class RoomUserRemoveRightsEvent extends MessageHandler {
             for (int i = 0; i < amount; i++) {
                 int userId = this.packet.readInt();
 
+                if (!RoomUserInputGuard.isPositiveId(userId))
+                    continue;
+
                 room.removeRights(userId);
             }
         }

Emulator/src/main/java/com/eu/habbo/messages/incoming/rooms/users/UnbanRoomUserEvent.java

@@ -10,6 +10,10 @@ public class UnbanRoomUserEvent extends MessageHandler {
         int userId = this.packet.readInt();
         int roomId = this.packet.readInt();
 
+        if (!RoomUserInputGuard.isPositiveId(userId) || !RoomUserInputGuard.isPositiveId(roomId)) {
+            return;
+        }
+
         Room room = this.client.getHabbo().getHabboInfo().getCurrentRoom();
         if (room == null || room.getId() != roomId) {
             return;

Emulator/src/main/java/com/eu/habbo/messages/incoming/trading/TradeOfferMultipleItemsEvent.java

@@ -19,8 +19,15 @@ public class TradeOfferMultipleItemsEvent extends MessageHandler {
         THashSet<HabboItem> items = new THashSet<>();
 
         int count = this.packet.readInt();
+        if (count <= 0 || count > RoomTrade.MAX_OFFERED_ITEMS)
+            return;
+
         for (int i = 0; i < count; i++) {
-            HabboItem item = this.client.getHabbo().getInventory().getItemsComponent().getHabboItem(this.packet.readInt());
+            int itemId = this.packet.readInt();
+            if (itemId <= 0)
+                continue;
+
+            HabboItem item = this.client.getHabbo().getInventory().getItemsComponent().getHabboItem(itemId);
             if (item != null && item.getBaseItem().allowTrade()) {
                 items.add(item);
             }

Emulator/src/main/java/com/eu/habbo/messages/incoming/users/RequestProfileFriendsEvent.java

@@ -10,6 +10,10 @@ public class RequestProfileFriendsEvent extends MessageHandler {
     @Override
     public void handle() throws Exception {
         int userId = this.packet.readInt();
+
+        if (!UserInputGuard.isPositiveId(userId))
+            return;
+
         Habbo habbo = Emulator.getGameEnvironment().getHabboManager().getHabbo(userId);
 
         if (habbo != null)

Emulator/src/main/java/com/eu/habbo/messages/incoming/users/RequestUserProfileEvent.java

@@ -10,6 +10,10 @@ public class RequestUserProfileEvent extends MessageHandler {
     @Override
     public void handle() throws Exception {
         int habboId = this.packet.readInt();
+
+        if (!UserInputGuard.isPositiveId(habboId))
+            return;
+
         Habbo habbo = Emulator.getGameEnvironment().getHabboManager().getHabbo(habboId);
 
         if (habbo != null)