search

Stanzilla / WoWUIBugs

World of Warcraft UI Bug Tracker
153 stars 7 forks source link

Execution of C_CovenantSanctumUI.DepositAnima, supposedly C-side function is tainted by insecure PlayerInteractionFrameManager.ShowFrame #464

Closed rowaasr13 closed 10 months ago

rowaasr13 commented 10 months ago

Execution of C_CovenantSanctumUI.DepositAnima, despite supposedly C-side function is tainted by some insecure values from Bagnon addon.

Blizzard_VoidStorageUI.xml Bagnon version: 10.1.4 (But also seen reported on Bagnon's tracker much earlier in DF) Blizzard TOC version: 100105

I'm still working on minimal example, but right now it can be readily observed by using "Bagnon" addon that overrides PlayerInteractionFrameManager.ShowFrame in Interface\AddOns\BagBrother\core\features\autoDisplay.lua in this line:

    self:StopIf(PlayerInteractionFrameManager, 'ShowFrame', function(manager, type)

(StopIf function installs insecure pre-hook).

Specifically it is this fragment inside function body that affects deposit, if you comment out it alone deposit starts to work: type == Interactions.VoidStorageBanker and Addon.Frames:Show('vault'). So it boils down to canceling loading of standard "Blizzard_VoidStorageUI" addon and building own UI, presumably writing some insecure values in place where C_CovenantSanctumUI.DepositAnima reads them for some reason.

Simply running /run C_CovenantSanctumUI.DepositAnima() after loading unmodified Bagnon causes "Bagnon has been blocked..." window.

While Bagnon likely shouldn't try to replace deeply-ingrained details of UI with insecure variants, C_CovenantSanctumUI.DepositAnima being an API function with unavailable code should not depend on anything from Lua environment or at least should not acquire execution taint from it or be able to filter it.

Meorawr commented 10 months ago

Not a bug; this function is intentionally protected and as such can't be called from insecure code paths.