Prevent PlaceholderAPI output from being evaluated as AdvancedCore JavaScript in reward commands

AdvancedCore/src/main/java/com/bencodez/advancedcore/api/messages/PlaceholderUtils.java

@@ -181,6 +181,25 @@ public static String replaceJavascript(OfflinePlayer player, String text) {
 		return text;
 	}
 
+	public static ArrayList<String> replaceJavascriptOnly(OfflinePlayer player, ArrayList<String> list) {
+		ArrayList<String> msg = new ArrayList<>();
+		for (String str : list) {
+			msg.add(replaceJavascriptOnly(player, str));
+		}
+		return msg;
+	}
+
+	public static String replaceJavascriptOnly(OfflinePlayer player, String text) {
+		if (AdvancedCorePlugin.getInstance().getOptions().isJavascriptEngineEnabled()) {
+			if (player.isOnline()) {
+				return replaceJavascriptOnly(player.getPlayer(), text);
+			}
+			JavascriptEngine engine = new JavascriptEngine().addPlayer(player);
+			return replaceJavascript(text, engine);
+		}
+		return text;
+	}
+
 	public static ArrayList<String> replaceJavascript(Player player, ArrayList<String> list) {
 		ArrayList<String> msg = new ArrayList<>();
 		for (String str : list) {
@@ -198,6 +217,22 @@ public static String replaceJavascript(Player player, String text) {
 		return msg;
 	}
 
+	public static ArrayList<String> replaceJavascriptOnly(Player player, ArrayList<String> list) {
+		ArrayList<String> msg = new ArrayList<>();
+		for (String str : list) {
+			msg.add(replaceJavascriptOnly(player, str));
+		}
+		return msg;
+	}
+
+	public static String replaceJavascriptOnly(Player player, String text) {
+		if (AdvancedCorePlugin.getInstance().getOptions().isJavascriptEngineEnabled()) {
+			JavascriptEngine engine = new JavascriptEngine().addPlayer(player);
+			return replaceJavascript(text, engine);
+		}
+		return text;
+	}
+
 	public static String replaceJavascript(String text) {
 		return replaceJavascript(text, null);
 	}

AdvancedCore/src/main/java/com/bencodez/advancedcore/api/misc/MiscUtils.java

@@ -174,11 +174,11 @@ public void executeConsoleCommands(final Player player, final ArrayList<String>
 			final HashMap<String, String> placeholders, boolean stagger) {
 		if (cmds != null && !cmds.isEmpty()) {
 			placeholders.put("player", player.getName());
-			ArrayList<String> commands = PlaceholderUtils.replacePlaceHolder(cmds, placeholders);
+			ArrayList<String> commands = PlaceholderUtils.replaceJavascriptOnly(player, cmds);
+			commands = PlaceholderUtils.replacePlaceHolder(commands, placeholders);
 			commands = PlaceholderUtils.replacePlaceHolders(commands, player);
-			final ArrayList<String> finalCommands = PlaceholderUtils.replaceJavascript(player, commands);
 			int tick = 0;
-			for (final String cmd : finalCommands) {
+			for (final String cmd : commands) {
 				plugin.debug("Executing console command: " + cmd);
 				runConsoleCommand(cmd, tick, stagger);
 			}
@@ -188,9 +188,10 @@ public void executeConsoleCommands(final Player player, final ArrayList<String>
 
 	public void executeConsoleCommands(Player player, String command, HashMap<String, String> placeholders) {
 		if (command != null && !command.isEmpty()) {
-			String cmd = PlaceholderUtils.replacePlaceHolder(command, placeholders);
+			String cmd = PlaceholderUtils.replaceJavascriptOnly(player, command);
+			cmd = PlaceholderUtils.replacePlaceHolder(cmd, placeholders);
 			cmd = PlaceholderUtils.replacePlaceHolders(player, cmd);
-			final String finalCommand = PlaceholderUtils.replaceJavascript(player, cmd);
+			final String finalCommand = cmd;
 
 			plugin.debug("Executing console command: " + command);
 			plugin.getBukkitScheduler().executeOrScheduleSync(plugin, new Runnable() {
@@ -211,10 +212,13 @@ public void executeConsoleCommands(final String playerName, final ArrayList<Stri
 		if (cmds != null && !cmds.isEmpty()) {
 			placeholders.put("player", playerName);
 			OfflinePlayer p = Bukkit.getOfflinePlayer(playerName);
-			ArrayList<String> commands = PlaceholderUtils.replacePlaceHolder(cmds, placeholders);
+			ArrayList<String> commands = cmds;
+			if (p != null) {
+				commands = PlaceholderUtils.replaceJavascriptOnly(p, commands);
+			}
+			commands = PlaceholderUtils.replacePlaceHolder(commands, placeholders);
 			if (p != null) {
 				commands = PlaceholderUtils.replacePlaceHolders(p, commands);
-				commands = PlaceholderUtils.replaceJavascript(p, commands);
 			}
 			int tick = 0;
 			for (final String cmd : commands) {
@@ -227,10 +231,12 @@ public void executeConsoleCommands(final String playerName, final ArrayList<Stri
 	public void executeConsoleCommands(String playerName, String command, HashMap<String, String> placeholders) {
 		if (command != null && !command.isEmpty()) {
 			OfflinePlayer p = Bukkit.getOfflinePlayer(playerName);
+			if (p != null) {
+				command = PlaceholderUtils.replaceJavascriptOnly(p, command);
+			}
 			command = PlaceholderUtils.replacePlaceHolder(command, placeholders);
 			if (p != null) {
 				command = PlaceholderUtils.replacePlaceHolders(p, command);
-				command = PlaceholderUtils.replaceJavascript(p, command);
 			}
 			if (command.startsWith("/")) {
 				command.replaceFirst("/", "");

AdvancedCore/src/test/java/com/bencodez/advancedcore/tests/messages/PlaceholderUtilsTest.java

@@ -0,0 +1,38 @@
+package com.bencodez.advancedcore.tests.messages;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.mockStatic;
+import static org.mockito.Mockito.when;
+
+import org.bukkit.entity.Player;
+import org.junit.jupiter.api.Test;
+import org.mockito.MockedStatic;
+
+import com.bencodez.advancedcore.AdvancedCoreConfigOptions;
+import com.bencodez.advancedcore.AdvancedCorePlugin;
+import com.bencodez.advancedcore.api.messages.PlaceholderUtils;
+
+import me.clip.placeholderapi.PlaceholderAPI;
+
+public class PlaceholderUtilsTest {
+
+	@Test
+	public void replaceJavascriptOnlyDoesNotExpandPlaceholderApiOutput() {
+		AdvancedCorePlugin plugin = mock(AdvancedCorePlugin.class);
+		AdvancedCoreConfigOptions options = mock(AdvancedCoreConfigOptions.class);
+		Player player = mock(Player.class);
+		String command = "say %untrusted%";
+
+		when(plugin.getOptions()).thenReturn(options);
+		when(options.isJavascriptEngineEnabled()).thenReturn(false);
+
+		try (MockedStatic<AdvancedCorePlugin> pluginStatic = mockStatic(AdvancedCorePlugin.class);
+				MockedStatic<PlaceholderAPI> placeholderApiStatic = mockStatic(PlaceholderAPI.class)) {
+			pluginStatic.when(AdvancedCorePlugin::getInstance).thenReturn(plugin);
+
+			assertEquals(command, PlaceholderUtils.replaceJavascriptOnly(player, command));
+			placeholderApiStatic.verifyNoInteractions();
+		}
+	}
+}