Skip non-name JSON values safely

Co-authored-by: NotMyFault <13383509+NotMyFault@users.noreply.github.com>

Author: Copilot

src/main/java/com/thevoxelbox/voxelsniper/VoxelSniperPlugin.java

@@ -336,39 +336,45 @@ private static String findLatestVersionName(String response) {
         }
 
         String lastObject = response.substring(lastObjectStart, lastObjectEnd);
-        int objectDepth = 0;
-        for (int index = 0; index < lastObject.length(); index++) {
-            char character = lastObject.charAt(index);
-            if (character == '"') {
-                int stringEnd = findStringEnd(lastObject, index + 1);
-                if (stringEnd == -1) {
+        for (int index = 1; index < lastObject.length() - 1; ) {
+            index = skipWhitespace(lastObject, index);
+            if (index >= lastObject.length() - 1) {
+                break;
+            }
+            if (lastObject.charAt(index) == ',') {
+                index++;
+                continue;
+            }
+            if (lastObject.charAt(index) != '"') {
+                return null;
+            }
+
+            int keyEnd = findStringEnd(lastObject, index + 1);
+            if (keyEnd == -1) {
+                return null;
+            }
+            String key = lastObject.substring(index + 1, keyEnd);
+            int colonIndex = skipWhitespace(lastObject, keyEnd + 1);
+            if (colonIndex >= lastObject.length() || lastObject.charAt(colonIndex) != ':') {
+                return null;
+            }
+            int valueStart = skipWhitespace(lastObject, colonIndex + 1);
+            if ("name".equals(key)) {
+                if (valueStart >= lastObject.length() || lastObject.charAt(valueStart) != '"') {
                     return null;
                 }
-                if (objectDepth == 1) {
-                    String key = lastObject.substring(index + 1, stringEnd);
-                    int colonIndex = skipWhitespace(lastObject, stringEnd + 1);
-                    if (colonIndex < lastObject.length() && lastObject.charAt(colonIndex) == ':') {
-                        int valueStart = skipWhitespace(lastObject, colonIndex + 1);
-                        if ("name".equals(key) && valueStart < lastObject.length() && lastObject.charAt(valueStart) == '"') {
-                            int valueEnd = findStringEnd(lastObject, valueStart + 1);
-                            if (valueEnd == -1) {
-                                return null;
-                            }
-                            return lastObject.substring(valueStart + 1, valueEnd);
-                        }
-                    }
+                int valueEnd = findStringEnd(lastObject, valueStart + 1);
+                if (valueEnd == -1) {
+                    return null;
                 }
-                index = stringEnd;
-                continue;
-            }
-            if (character == '{') {
-                objectDepth++;
-                continue;
+                return lastObject.substring(valueStart + 1, valueEnd);
             }
-            if (character == '}') {
-                objectDepth--;
-                continue;
+
+            int valueEnd = skipJsonValue(lastObject, valueStart);
+            if (valueEnd == -1) {
+                return null;
             }
+            index = valueEnd + 1;
         }
         return null;
     }
@@ -396,4 +402,58 @@ private static int skipWhitespace(String input, int startIndex) {
         return index;
     }
 
+    private static int skipJsonValue(String input, int startIndex) {
+        if (startIndex >= input.length()) {
+            return -1;
+        }
+        char character = input.charAt(startIndex);
+        if (character == '"') {
+            return findStringEnd(input, startIndex + 1);
+        }
+        if (character == '{' || character == '[') {
+            char open = character;
+            char close = character == '{' ? '}' : ']';
+            int depth = 1;
+            boolean inString = false;
+            boolean escaping = false;
+            for (int index = startIndex + 1; index < input.length(); index++) {
+                char current = input.charAt(index);
+                if (escaping) {
+                    escaping = false;
+                    continue;
+                }
+                if (inString) {
+                    if (current == '\\') {
+                        escaping = true;
+                    } else if (current == '"') {
+                        inString = false;
+                    }
+                    continue;
+                }
+                if (current == '"') {
+                    inString = true;
+                    continue;
+                }
+                if (current == open) {
+                    depth++;
+                } else if (current == close) {
+                    depth--;
+                    if (depth == 0) {
+                        return index;
+                    }
+                }
+            }
+            return -1;
+        }
+        int index = startIndex;
+        while (index < input.length()) {
+            char current = input.charAt(index);
+            if (current == ',' || current == '}') {
+                return index - 1;
+            }
+            index++;
+        }
+        return input.length() - 1;
+    }
+
 }