Facepunch / sbox-issues

178 stars 12 forks source link

Decompiling addons can show full file paths with Razor files. Potentially doxing people. #4060

Closed StealthNinja1O1 closed 11 months ago

StealthNinja1O1 commented 1 year ago

Describe the bug

Using dnSpy you can find full file paths like "C:\users\...\documents\s&box projects\...\UI\Menu\Menu.razor" This can be fine, but people like me might have their real name in their Windows username, doxing themselves if you have not moved your projects to another disk.

Those details are in the BuildRenderTree function in Razor files. For example, this is in Sausage Survivors (No dox, hope this is ok)

protected override void BuildRenderTree(RenderTreeBuilder __builder)
{
    __builder.AddLocation("C:\\git\\sbox-2dtest\\code\\GameMenu\\LoadingPanel.razor", 10, 0);
    __builder.OpenElement(0, "root");
    __builder.AddAttribute(1, "class", "loadingpanel");
    __builder.AddLocation("C:\\git\\sbox-2dtest\\code\\GameMenu\\LoadingPanel.razor", 12, 4);
    __builder.AddMarkupContent(2, "<div class=\"title\">LOADING GAME</div>\r\n\r\n    ");
    __builder.AddLocation("C:\\git\\sbox-2dtest\\code\\GameMenu\\LoadingPanel.razor", 14, 4);
    __builder.OpenElement(3, "div");
    __builder.AddAttribute(4, "class", "subtitle");
    __builder.AddContent<string>(5, this.Progress.Title);
    __builder.CloseElement();
    __builder.CloseElement();
}

To Reproduce

Expected behavior

Not hardcoding file paths in BuildRenderTree that for most people will not even exist?

Media/Files

image

Additional context

This is on windows, but with linux having names in the path too it might have the same issue. (idk about macos)

trende2001 commented 1 year ago

lol...