Closed Ecdcaeb closed 1 month ago
WTF
What are you trying to do here? Are you trying to execute scripts from a script or from an addon? DONT DO THIS! It's dangerous and will lead to issues!
What are you trying to do here? Are you trying to execute scripts from a script or from an addon? DONT DO THIS! It's dangerous and will lead to issues!
trying to execute scripts from a script or from an addon
I still stick to my point of view. This mixin of GroovyScript destroys the groovy library, and this PR gives other mods the right to use groovy. In addition, it also makes the following if (this.packageNode == null || this.context == null) return;
meaningful.
Of course, the above is based on "banning heterologous scripts is not a deliberate design." If this is a deliberate design rather than an oversight, please close this pr.
I will not support direct usage of GroovyClassLoader
by any means. If you absolutly need it, i can add a method to GroovyScriptSandbox
I will not support direct usage of
GroovyClassLoader
by any means. If you absolutly need it, i can add a method toGroovyScriptSandbox
I didn't make my point clear at all. I meant to say that other mods written in Java can't use groovy, not in scripts.
The effect of this mixin is global, not just GroovyScript scripts.
That doesnt change anything. The direct use of GroovyClassLoader
can be dangerous. Especially if you barely have any idea what you are doing.
I want to repeat my thoughts in a short session. GroovyScript should not assume that the user of groovy has and only has GroovyScript.
// status quo:
public static Class<?> compile(GroovyClassLoader loader, String name, String text){
if(Loader.isLoaded("groovyscript")) return loader.paresClass(text, GroovyScript.getScriptPath() + '/' + name);
else return loader.paresClass(text, name);
}
This pr can cancel the above method so that GroovyScript does not need to be considered.
1) This is not executing the script in the script, and this pr does not introduce this operation.
2) This is not designed for GroovyScript, but removes the damage that GroovyScript does to groovy. Adding methods to GroovyScriptSandbox
will not help. Mods that use groovy must consider GroovyScript in this case anyway.
3) This PR does not undermine security, because it is not currently secure. The above code can also solve the problem, the only problem is that when using groovy, you must consider GroovyScript.
In the current situation, I completely think this is a design flaw.
To prove it, I might try making a mod (in other uses) that uses Groovy but doesn't depend on GroovyScript.
Now I understand. I will reconsider this pr
the damage that GroovyScript does to groovy
I just never considered someone else using the groovy lib
Implemented in #235 because reasons
Don't assume that all scripts come from GroovyScript. This mixin breaks other mods' use of groovy, and scripts not from the groovyscript path do not work as expected.
The following example does not work in a GroovyScript environment.