FNF-CNE-Devs / CodenameEngine

awesome fnf engine :D
Apache License 2.0
253 stars 172 forks source link

Safe Mode implementation #306

Closed Jamextreme140 closed 4 months ago

Jamextreme140 commented 4 months ago

It disables the usage of classes that can perform malicious operations like Sys.command() and cpp.Lib.load().

Reflect and Type are disallowed since it can access to blacklisted classes (Reflect.callMethod() and Type.resolveClass())

Example: A song script tries to execute this following song script (function postCreate()): trace(Reflect.getProperty(PlayState, "difficulty")) Sys.command("echo Howdy")

Captura de pantalla 2024-06-01 124626 After disabled "Safe mode" it works normally again

Safe Mode mark when it's enabled Captura de pantalla 2024-06-01 124528

NeeEoo commented 4 months ago

while(Script.importBlocklist.length > 0) Script.importBlocklist.pop()

NexIsDumb commented 4 months ago

and i'm also not sure about this either, well also first of all cause its easily avoidable as neeo made you see but also cause it would create MANY limitations

Jamextreme140 commented 4 months ago

Wait. I think I have a better idea for Safe Mode

NeeEoo commented 4 months ago

We came up with a idea where like its gonna be like a toggle thats by default off

Jamextreme140 commented 4 months ago

Yeah, that's exactly what I was thinking about. Safe Mode as an Option instead of a separated build

usb-port-2 commented 4 months ago

This SUCKS so GODDAMN MUCH.

I should be able to DESTROY your PC via my SILLY and FUNNY rhythm game song.

Jamextreme140 commented 4 months ago

We came up with a idea where like its gonna be like a toggle thats by default off

check you the edited first comment and latest commit

NeeEoo commented 4 months ago

We could probably just do @:unreflective on hscript-improved to turn off being able to edit it

Jamextreme140 commented 4 months ago

We could probably just do @:unreflective on hscript-improved to turn off being able to edit it

Hmm, it can work