Ensures external libraries can't be called by callbacks (#71346)

## About The Pull Request

It is possible to create a callback whose `object` (the datum it tries
to call) is a path to an external library. Needless to say, it's
probably a bad idea to allow admins to call arbitrary external
libraries. Var-edited callbacks won't be able to reach the point where
the library is executed, but only because `WrapAdminProcCall` runtimes
when trying to call `CanProcCall` on a string, but if there is some way
to call a function that creates a non-varedited callback with an
external library as its object, this PR prevents that.

## Why It's Good For The Game

See above.

## Changelog

🆑
admin: Admins are unable to invoke functions from external libraries
using callbacks.
/🆑
This commit is contained in:
Y0SH1M4S73R
2022-11-22 05:14:46 +00:00
committed by GitHub
parent 4f9d2e6d63
commit 533d235e51
+12
View File
@@ -109,6 +109,12 @@
if (!object)
return
#if DM_VERSION <= 514
if(istext(object) && object != GLOBAL_PROC)
to_chat(usr, "[object] may be an external library. Calling external libraries is disallowed.", confidential = TRUE)
return
#endif
var/list/calling_arguments = arguments
if (length(args))
if (length(arguments))
@@ -146,6 +152,12 @@
if (!object)
return
#if DM_VERSION <= 514
if(istext(object) && object != GLOBAL_PROC)
to_chat(usr, "[object] may be an external library. Calling external libraries is disallowed.", confidential = TRUE)
return
#endif
var/list/calling_arguments = arguments
if (length(args))
if (length(arguments))