4 ms·

I don't think so. The attacker is executing script through the RemoveExtraSpaces function that gets run on every chat message, not by executing it with either

• niftich 10y ago
  The assumption is that a proper mitigation would result in the script console being in a separate execution context; such that variables that are (re-)declared in the script console would not affect the chat console's context, or its 'RemoveExtraSpaces' function, nor the global context. I should've been more clear.
  • eridius 10y ago
    That assumption wouldn't work. If the script console is a separate Lua environment, it's completely useless. As long as it's the same environment that the rest of the game/addons use (which it must be), then there's no "mitigation" that can be done like you're hoping for.