From 533d235e511ef3786a3a633ee626695e0db01dd1 Mon Sep 17 00:00:00 2001 From: Y0SH1M4S73R Date: Tue, 22 Nov 2022 00:14:46 -0500 Subject: [PATCH] Ensures external libraries can't be called by callbacks (#71346) ## About The Pull Request It is possible to create a callback whose `object` (the datum it tries to call) is a path to an external library. Needless to say, it's probably a bad idea to allow admins to call arbitrary external libraries. Var-edited callbacks won't be able to reach the point where the library is executed, but only because `WrapAdminProcCall` runtimes when trying to call `CanProcCall` on a string, but if there is some way to call a function that creates a non-varedited callback with an external library as its object, this PR prevents that. ## Why It's Good For The Game See above. ## Changelog :cl: admin: Admins are unable to invoke functions from external libraries using callbacks. /:cl: --- code/datums/callback.dm | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/code/datums/callback.dm b/code/datums/callback.dm index 03d25f1d8f1..30cca6fd49c 100644 --- a/code/datums/callback.dm +++ b/code/datums/callback.dm @@ -109,6 +109,12 @@ if (!object) return +#if DM_VERSION <= 514 + if(istext(object) && object != GLOBAL_PROC) + to_chat(usr, "[object] may be an external library. Calling external libraries is disallowed.", confidential = TRUE) + return +#endif + var/list/calling_arguments = arguments if (length(args)) if (length(arguments)) @@ -146,6 +152,12 @@ if (!object) return +#if DM_VERSION <= 514 + if(istext(object) && object != GLOBAL_PROC) + to_chat(usr, "[object] may be an external library. Calling external libraries is disallowed.", confidential = TRUE) + return +#endif + var/list/calling_arguments = arguments if (length(args)) if (length(arguments))