[1.16.5] ServerRecipePlacerMixin (Recipe Book NBT Fix) does not handle item NBT appropriately

[Sophie847]

The ServerRecipePlacerMixin completely ignores item NBT when placing items into the crafting menu. This causes two issues:

Firstly, mods or datapacks may include crafting recipes which specifically require particular NBT on their ingredients - with this mixin applied, items which aren't actually compatible with the recipe can be put into the crafting interface. This can cause confusion for players, when the crafting interface does not produce the output the recipe book suggests it should.

The second, and much more significant issue, is that items with distinctly differing NBT tags can be stacked in the crafting interface, which permanently alters the NBT of the item being stacked. It is commonplace in other mods, or especially in datapacks (where it is not possible to register new items), to apply a tag to an existing item, and then have items with the tag behave completely differently (as far as the player is concerned, it's a different item). So by enabling the NBT of the item to be altered via the recipe book, players can exploit the system to turn less valuable items into more valuable ones that share the same item ID (only differ by NBT).

One such example of this behavior causing issues is with The Pixelmon Mod, which uses NBT tags to differentiate between different types of pokeballs, but all share the same item ID.

Below is the recipe file for pixelmons "Old Rod" item, which requires a basic poke ball (it specifies the PokeBallID tag of "poke_ball", meaning other types of pokeballs are invalid):

Old Rod Recipe (Expand)

old_rod.json

{
  "type": "minecraft:crafting_shaped",
  "pattern": [
    "  S",
    " ST",
    "S P"
  ],
  "key": {
    "S": {
      "tag": "forge:rods/wooden"
    },
    "T": {
      "item": "minecraft:string"
    },
    "P": {
      "type": "forge:nbt",
      "item": "pixelmon:poke_ball",
      "nbt": {
        "PokeBallID": "poke_ball"
      }
    }
  },
  "result": {
    "item": "pixelmon:old_rod",
    "count": 1
  }
}

As seen in the video below, I use the recipe book to fill the crafting interface with the required ingredients to make an Old Rod - however the master ball sits in a slot checked before that of the basic poke balls, so the master ball is placed into the crafting menu instead (even though this recipe is invalid, and as shown, produces no output).

I then shift-click the recipe for the Old Rod from the recipe book; The mixin considers the regular poke balls an appropriate item to stack on top of the master ball in the crafting interface, when they should not be. As a result, my regular poke balls are converted into (significantly rarer) master balls.

Base.Profile.2023.08.16.-.01.19.13.10_Trim.mp4

Such an exploit could be carried out on any item which differs based on NBT, and is involved in at least one crafting recipe.

Mods Used:
Randompatches 2.4.4
Pixelmon 9.1.6