3 ms·
I'm not sure how that would solve anything, the attacker would just convince the victim to type that line of code into the script console instead of the chat co
by eridius 10y ago
I'm not sure how that would solve anything, the attacker would just convince the victim to type that line of code into the script console instead of the chat console.
- alistairSH 10y agoSure, the rebinding could still happen. But, the remote execution is prevented (right now, after rebinding the trim function, the attacker can enter script in the chat window to be executed - this part goes away with a separate console).
- TheCoelacanth 10y agoI don't think so. The attacker is executing script through the RemoveExtraSpaces function that gets run on every chat message, not by executing it with either player's chat console.
- niftich 10y agoThe assumption is that a proper mitigation would result in the script console being in a separate execution context; such that variables that are (re-)declared in the script console would not affect the chat console's context, or its 'RemoveExtraSpaces' function, nor the global context. I should've been more clear.
- eridius 10y agoThat assumption wouldn't work. If the script console is a separate Lua environment, it's completely useless. As long as it's the same environment that the rest of the game/addons use (which it must be), then there's no "mitigation" that can be done like you're hoping for.
- ahoy 10y agoYou (presumably) couldn't send chat messages directly to another player's script console, which is how this works.