5 ms·
Another contributing factor in this vulnerability is that the 'chat compose input' and the 'script console' are one and the same. While this was done to simpli
by niftich 10y ago
Another contributing factor in this vulnerability is that the 'chat compose input' and the 'script console' are one and the same.
While this was done to simplify UX, it's really not a good idea in retrospect.
Even as something simple as a different chat frame that only allowed script commands, into which only local script output can go, would also serve as an effective mitigation.
- seanp2k2 10y agoOr do it like Quake and HL did and have tilde be the console. You can do things like "/say foo" or commands / settings through there, and in the case of quake at least, it can load scripts from files in a directory. This is not new stuff, and it's surprising that it doesn't do this already. Example: http://ezquake.sourceforge.net/docs/?scripting http://ezquake.sourceforge.net/docs/?scripting
- ryanlol 10y agoIt supports this already, or at least did. Console just needs to be manually enabled.
- eridius 10y agoI'm not sure how that would solve anything, the attacker would just convince the victim to type that line of code into the script console instead of the chat console.
- alistairSH 10y agoSure, the rebinding could still happen. But, the remote execution is prevented (right now, after rebinding the trim function, the attacker can enter script in the chat window to be executed - this part goes away with a separate console).
- TheCoelacanth 10y agoI don't think so. The attacker is executing script through the RemoveExtraSpaces function that gets run on every chat message, not by executing it with either player's chat console.
- niftich 10y agoThe assumption is that a proper mitigation would result in the script console being in a separate execution context; such that variables that are (re-)declared in the script console would not affect the chat console's context, or its 'RemoveExtraSpaces' function, nor the global context. I should've been more clear.
- eridius 10y agoThat assumption wouldn't work. If the script console is a separate Lua environment, it's completely useless. As long as it's the same environment that the rest of the game/addons use (which it must be), then there's no "mitigation" that can be done like you're hoping for.
- ahoy 10y agoYou (presumably) couldn't send chat messages directly to another player's script console, which is how this works.